CRITICAL 9.1 NVD
CVE-2026-89086
In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the
In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.
References
- https://github.com/ulrikstrid/ocaml-jose/commit/cf17d991ec6a0d1997956b6c7799890f9c28879e
- https://osv.dev/vulnerability/OSEC-2026-19
This critical severity vulnerability with a CVSS score of 9.1 was published on 2026-09-10 via NVD.
Risk Timeline
CVE Disclosed2026-09-10 · 1 day ago
Remediation Resources
vulnfeed aggregates 12842 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.