LoadPublicKey performs an unchecked type assertion on an ECDSA options object when resolving the curve for an EC key. A JSON Web Key that declares "kty":"EC" while using a non‑EC "alg" triggers this assertion and causes the application to panic, effectively crashing the process. This vulnerability is a classic example of improper type checking and results in a denial of service by terminating the service that relied on the key.

The vulnerability affects the Eclipse KeyPont GOSE library distributed by the Eclipse Foundation. No specific version information is provided, so all released versions of Eclipse KeyPont GOSE are potentially affected until an update with the fix is applied.

The CVSS score of 6.3 indicates moderate severity. EPSS information is not available, and the vulnerability has not been listed in the CISA KEV catalog. An attacker can supply a malicious JWK with a mismatched kty and alg that causes the application to panic when LoadPublicKey is invoked. The attack vector is likely local or remote depending on how the key is loaded, but the impact is limited to availability as the panic ends the process rather than enabling code execution or privilege escalation.