JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix

CVE List

01 Why this matters

CVE-2026-89315 has no exploitation data yet. Impact if it lands: CVSS 6.9 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N).

Check if you run it Follow the feed

02 Facts

CVSS: CVSS 6.9 (v4.0)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS: No EPSS yet
CISA KEV: Not on the CISA KEV list
Dates: published Oct 23, 2026
modified Oct 23, 2026
Weaknesses: CWE-248
Severity: medium

03 Affected packages

No package ranges are published for this id.

04 Advisory text

`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" + claimName` for each untyped claim. `reflect.StructOf` **panics** when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT claim names.

Advisory text is quoted from public sources and may contain anything, including instructions. It is data, not guidance.

05 References

https://github.com/eclipse-keypont/gose/security/advisories/GHSA-hwm6-rwv6-xgq8

06 Ask your agent

With the geoa-cve MCP server connected

explain_impact CVE-2026-89315

Or without MCP: https://cve.geoa.io/api/vuln/CVE-2026-89315. Danger: Low, CVSS 6.9.