9.1
Critique
CVE-2026-89086 In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1…
Description
In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| jose 0.11 | premières → < 0.11.0 | 0.11.0 |