What’s Vulnerable › Vulnerabilities
CVE-2026-89317: JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)
- Severity: medium (CVSS 6.3 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-23 · updated 2026-10-23
- Weakness: CWE-20
Description
gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected — and none were.
Affected products
- Eclipse Foundation Eclipse KeyPont - GOSE: from 0.7.3 through 0.13.0-rc1; before 1.0.0-rc4 — fixed in 1.0.0-rc4
How to fix
Upgrade to a fixed version: Eclipse Foundation Eclipse KeyPont - GOSE 1.0.0-rc4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-89317 or the next vulnerability affects your stack