All vulnerabilities
CVE-2026-89317GHSA-445r-fpvv-hgwc

Eclipse KeyPont - GOSE: JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)

Eclipse Foundation Eclipse KeyPont - GOSE
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 3% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.0.0-rc4Fixed versionCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

gose parsed the JWS crit header into JwsHeader.Crit and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty crit should have been rejected — and none were.

Text from CVE List

Affected versions 4

  • Eclipse KeyPont - GOSEaffected: 0.7.3 through 0.13.0-rc1CVE List
  • Eclipse KeyPont - GOSEaffected: all versions before 1.0.0-rc4CVE List
  • github.com/ThalesGroup/gose, go>= 0.7.3, <= 0.13.0-rc1GitHub
  • github.com/eclipse-keypont/gose, go< 1.0.0-rc4GitHub

References 1