JWS Header Parsing Issue in gose by Eclipse Keypont
CVE-2026-89317

6.3MEDIUM

Key Information:

Vendor

Eclipse Foundation

Status
Eclipse Keypont - Gose
Vendor
CVE Published:
23 October 2026

What is CVE-2026-89317?

The gose library by Eclipse Keypont has a vulnerability related to the handling of the JSON Web Signature (JWS) crit header. According to the JWS specification (RFC 7515 §4.1.11), any JWS containing critical extensions that are not understood by the recipient must be rejected. However, the gose implementation fails to validate these critical extensions, leading to a potential security gap, as tokens with non-empty crit extensions could be accepted, compromising the integrity of the JWS verification process.

Affected Version(s)

Eclipse KeyPont - GOSE 0.7.3 <= 0.13.0-rc1

Eclipse KeyPont - GOSE 0 < 1.0.0-rc4

References

https://github.com/eclipse-keypont/gose/security/advisori...

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eclipse Foundation Security Team
.