9.1
Critical
CVE-2026-89086 In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1…
Description
In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| jose 0.11 | earliest → < 0.11.0 | 0.11.0 |