← Database

CVE-2026-89086

CRITICAL CVSS: 9.1 Published: 2026-09-10 Modified: 2026-09-10

Description

In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.

Affected Platforms

Unknown

Weakness Type

CWE-347

References