PT-2026-89582
CVE-2026-89086
·
Published
2026-09-10
·
Updated
2026-09-22
Description by
CVSS 3.1
9.1
CriticalMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions
jose versions prior to 0.11.0
Description
The jose package for OCaml fails to properly validate RSA signatures. The library only confirms that PKCS #1 decoding succeeds but does not perform the necessary verification steps using the public key, allowing signatures to be declared valid regardless of the actual cryptographic validity.
Recommendations
Update jose to version 0.11.0 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾