CVE-2026-89317

Vulnerability Description

gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected — and none were.

Related Weaknesses (CWE)

CWE-347 CWE-20 CWE-1288

References

https://github.com/eclipse-keypont/gose/security/advisories/GHSA-445r-fpvv-hgwc

FAQ

What is CVE-2026-89317?

CVE-2026-89317 is a documented vulnerability. gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand....

How severe is CVE-2026-89317?

CVSS scoring is not yet available for CVE-2026-89317. Check NVD for updates.

Is there a patch for CVE-2026-89317?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.