gose Unvalidated JWS crit Header (Reject Violation)
CVE-2026-89317 Published on October 23, 2026
JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)
gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected and none were.
Vulnerability Analysis
CVE-2026-89317 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Types
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Improper Verification of Cryptographic Signature
The software does not verify, or incorrectly verifies, the cryptographic signature for data.
Improper Validation of Consistency within Input
The product receives a complex input with multiple elements or fields that must be consistent with each other, but it does not validate or incorrectly validates that the input is actually consistent.
Affected Versions
Eclipse Foundation Eclipse KeyPont - GOSE:- Version 0.7.3, <= 0.13.0-rc1 is affected.
- Before 1.0.0-rc4 is affected.