Priority HIGH 70
`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` without checking its length.
Vulnerabilities
7 records
Priority MEDIUM 61
gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it.
Priority MEDIUM 61
`LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`.
Priority HIGH 70
`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" + claimName` for each untyped claim.
Priority HIGH 70
`jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost grow with the **square** of the entry count.
Priority MEDIUM 61
`JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache.
Priority LOW 36
`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length.