The flaw occurs in the JWK unmarshalling routine where a pairwise nested loop checks for duplicate `key_ops` entries, causing the validation cost to grow quadratically with the number of entries. A maliciously crafted JWKS document containing a modest number of `key_ops` can cause a single CPU core to be occupied for many seconds, resulting in a denial‑of‑service that affects any process validating the key set.

The vulnerability impacts the Eclipse KeyPont – GOSE product from the Eclipse Foundation. No specific version information is available in the advisory; therefore any published release before a forthcoming fix could be affected.

With a CVSS score of 6.9, the vulnerability is considered medium severity, but the EPSS score is not available and it is not listed in CISA's KEV catalog. The attack is likely remote, requiring an attacker to supply a specially constructed JWKS document to a vulnerable server. The condition for exploitation is simply that the server performs untrusted JWKS unmarshalling, a common operation in many OIDC and OAuth implementations; no privileged access or additional steps are described.