CVE-2026-89314

MediumCVSS 6.9

Published: 23/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 23/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

17th percentile - higher than 17% of all known CVEs

Summary

jwkFields.CheckConsistency detected duplicate key_ops entries using a pairwise nested loop, making validation cost grow with the square of the entry count. Because the check runs on every JWK and JWKS unmarshal, a modestly sized but hostile JWKS document could occupy a CPU core for many seconds.

Risk Assessment

An attacker can supply a malicious JWKS document that causes CPU exhaustion (denial of service) in services processing JWKS. This may lead to slowdown or unavailability of the authentication service.

Recommendation

Update the library to a patched version and limit the size and entry count of processed JWKS documents. Consider monitoring JWKS processing time to detect attack attempts.

Other vulnerabilities in JWK/JWKS library

CVE-2026-89313Medium
JwksTrustStore.Get assigned each parsed key to the function's named return value while refreshing the JWKS cache. When the requested kid was not present, the trailing naked return handed the caller the last key in the JWKS document together with a nil error — a confidently wrong answer instead of "not found".

Original NVD description (English source)

`jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost grow with the **square** of the entry count. Because the check runs on every JWK and JWKS unmarshal, a modestly sized but hostile JWKS document could occupy a CPU core for many seconds.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS