Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2026-89317

JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
eclipse

Description

gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected — and none were.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Eclipse Foundation Eclipse KeyPont - GOSE

Default version status: unaffected

  • 0.7.3 to ≤ 0.13.0-rc1affected

Eclipse Foundation Eclipse KeyPont - GOSE

Default version status: unaffected

  • 0 to < 1.0.0-rc4affected

References