CVE-2026-89317

MediumCVSS 6.3

Published: 23/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 23/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

gose parsed the JWS crit header into JwsHeader.Crit and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand; gose implements no header extensions, so every token carrying a non-empty crit should have been rejected — and none were.

Risk Assessment

Tokens with unknown critical extensions are accepted, potentially leading to security bypass and unexpected token processing.

Recommendation

Update the gose library to a version containing the fix that rejects tokens with a non-empty crit header.

Other vulnerabilities in gose

CVE-2026-89320High
HmacShaCryptor.Hash never hashed its input — for any input it returned HMAC_K(""), the MAC of the empty message under the key. As a result, every AES-CBC-HMAC JWE produced or verified by gose carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.

Original NVD description (English source)

gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected — and none were.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS