CVE-2026-89086
Critical · CVSS 9.1- CVSS
- 9.1
- nvd
- EPSS
- —
- KEV
- No
- Class
- oss containerizable
- CWE-347
Description
In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.
Affected packages
| opam | jose | 0 → 0.11.0 |
| opam | jose | 0 → cf17d991ec6a0d1997956b6c7799890f9c28879e |
References
Status: profiled · ingested 2026-09-23T00:00:19.000Z