CVE-2026-89317 Details
Description
gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected — and none were.
A vulnerability exists in the Eclipse KeyPont gose library, specifically in versions through 1.0.0-rc1. The issue arises because the library's JWT verifier does not properly enforce the JWS 'crit' header, which is meant to indicate critical extension parameters that must be understood by the recipient. According to RFC 7515 §4.1.11, a JWS with unrecognized critical extensions should be rejected. However, gose accepts such JWS tokens without enforcing the 'crit' constraints, leading to a silent bypass of issuer-mandated requirements.
Users can upgrade to 'github.com/eclipse-keypont/gose' version 'v1.0.0-rc4' or later. For those still using 'github.com/ThalesGroup/gose', it is necessary to change the module path to 'github.com/eclipse-keypont/gose', as the ThalesGroup version is deprecated and vulnerable.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/eclipse-keypont/gose/security/advisories/GHSA-445r-fpvv-hgwc | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/eclipse-keypont/gose/security/advisories/GHSA-445r-fpvv-hgwc | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1288 | Improper Validation of Consistency within Input | [email protected] |
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Eclipse KeyPont gose | < 1.0.0-rc4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |