CVE-2026-89312
— UNSCOREDpublic exploit availablePublished 2026-10-23 · Updated 2026-10-23
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine.
Weaknesses
CWE-248
Public exploit & PoC references
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-100347PoC
- MEDIUMCVE-2026-100675PoC
- MEDIUMCVE-2026-100722PoC
- MEDIUMCVE-2026-101035PoC
- MEDIUMCVE-2026-101101PoC
- MEDIUMCVE-2026-101918PoC
- HIGHCVE-2026-102281PoC
- MEDIUMCVE-2026-102413
Related by shared AI tags and CWE weakness class. Browse the full archive.