PT-2026-89582
CVE-2026-89086
·
تاريخ النشر
2026-09-10
·
تاريخ التحديث
2026-09-22
الوصف من
CVSS 3.1
9.1
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions
jose versions prior to 0.11.0
Description
The jose package for OCaml fails to properly validate RSA signatures. The library only confirms that PKCS #1 decoding succeeds but does not perform the necessary verification steps using the public key, allowing signatures to be declared valid regardless of the actual cryptographic validity.
Recommendations
Update jose to version 0.11.0 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾