{"id":"CVE-2026-89317","kind":"vulnerability","aliases":["CVE-2026-89317"],"related":[],"title":"gose: JWS tokens with unknown critical headers are accepted","description":"gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected — and none were.","summary":"The gose Go library parsed the JWS crit header but never checked it, so tokens listing critical extensions it does not support were accepted. An attacker can present such a token and have it validated when RFC 7515 requires rejection.","severity":"medium","cvss":6.3,"epss":0.00147,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["go","gose","jws","jwt","package"],"not_affected_if":["no-jws-verification","signing-only"],"how_to_check":"- Look for the `github.com/mitchellh/gose` or `gose` module in `go.mod` and note the version.\n- Check whether your code uses `JwsHeader.Crit` or relies on gose to reject tokens with a `crit` header.","fix":null,"status":"open","published_at":"2026-10-23T09:17:08+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T04:00:05+00:00","updated_at":"2026-10-25T04:00:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:00:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"gose: JWS tokens with unknown critical headers are accepted","impact":"medium","summary":"The gose Go library parsed the JWS crit header but never checked it, so tokens listing critical extensions it does not support were accepted. An attacker can present such a token and have it validated when RFC 7515 requires rejection.","category":"package","nicknames":[],"who_cares":["go","jwt","jws","gose"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Tokens with unsupported critical extensions are accepted as valid","analyst_note":"Find the fixed gose version and whether it changes verification behavior, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-89317.","how_to_check":"- Look for the `github.com/mitchellh/gose` or `gose` module in `go.mod` and note the version.\n- Check whether your code uses `JwsHeader.Crit` or relies on gose to reject tokens with a `crit` header.","needs_analyst":true,"not_affected_if":["no-jws-verification","signing-only"],"who_is_affected":"Services that use the gose library to verify JWS tokens and make trust or authorization decisions from them. The risk depends on whether the signed token contents gate access; code that only signs tokens or does not verify them is not exposed by this flaw. Sources do not name a fixed version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000598,"input_tokens":3365,"output_tokens":522,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-89317':12A,15A '4.1.11':76C '7515':58B,75C 'accept':9A,44B 'attack':46B 'carri':101C 'check':32B 'crit':28B,65C,106C 'critic':6A,37B,86C 'cve':10A,13A 'empti':105C 'everi':99C 'extens':38B,87C,97C 'go':16B,23B 'gose':1A,17B,22B,61C,93C 'header':7A,29B,66C,96C 'implement':94C 'jws':2A,18B,27B,64C,83C 'jwsheader.crit':68C 'jwt':19B 'librari':24B 'list':36B,85C 'never':31B,71C 'non':104C 'non-empti':103C 'none':112C 'packag':20B 'paramet':88C 'pars':25B,62C 'present':48B 'read':72C 'recipi':79C 'reject':60B,81C,110C 'requir':59B,77C 'rfc':57B,74C 'support':42B 'token':3A,35B,51B,100C 'understand':92C 'unknown':5A 'valid':55B 'whose':84C","nicknames":[],"mitigations":[],"who_affected":"Services that use the gose library to verify JWS tokens and make trust or authorization decisions from them. The risk depends on whether the signed token contents gate access; code that only signs tokens or does not verify them is not exposed by this flaw. Sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T09:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89317","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89317","severity":null,"published_at":"2026-10-23T09:17:08+00:00","modified_at":"2026-10-23T19:30:07+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-89317","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89317","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}