RSA Signature Validation Flaw in jose Package for OCaml

CVE-2026-89086

What is CVE-2026-89086?

The jose package for OCaml, prior to version 0.11.0, contains a vulnerability where library calls intended to validate RSA signatures only confirm the success of PKCS #1 decoding. This flaw leads to a situation where signatures may be incorrectly accepted as valid, bypassing necessary checks involving the associated public key, thereby jeopardizing the integrity of cryptographic operations and exposing applications to potential exploitation through forged signatures.

References