---
id: "CVE-2026-89317"
kind: "vulnerability"
aliases: ["CVE-2026-89317"]
title: "gose: JWS tokens with unknown critical headers are accepted"
severity: "medium"
cvss: 6.3
epss: 0.00147
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["go", "gose", "jws", "jwt", "package"]
not_affected_if: ["no-jws-verification", "signing-only"]
published_at: "2026-10-23T09:17:08+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T04:00:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89317", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-89317", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# gose: JWS tokens with unknown critical headers are accepted

The gose Go library parsed the JWS crit header but never checked it, so tokens listing critical extensions it does not support were accepted. An attacker can present such a token and have it validated when RFC 7515 requires rejection.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for the `github.com/mitchellh/gose` or `gose` module in `go.mod` and note the version.
- Check whether your code uses `JwsHeader.Crit` or relies on gose to reject tokens with a `crit` header.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-89317
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-89317

## From the sources

gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected — and none were.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_