Live › vulnerability › CVE-2026-89317
Go to dashboardThe gose Go library parsed the JWS crit header but never checked it, so tokens listing critical extensions it does not support were accepted. An attacker can present such a token and have it validated when RFC 7515 requires rejection.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Services that use the gose library to verify JWS tokens and make trust or authorization decisions from them. The risk depends on whether the signed token contents gate access; code that only signs tokens or does not verify them is not exposed by this flaw. Sources do not name a fixed version.
No product ranges from the sources yet.
github.com/mitchellh/gose or gose module in go.mod and note the version.JwsHeader.Crit or relies on gose to reject tokens with a crit header.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
gose parsed the JWS crit header into JwsHeader.Crit and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty crit should have been rejected — and none were.
This page as .md · .json · in your agent: get_signal("CVE-2026-89317")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.