jose vulnerabilities

1 known vulnerability in jose from OCaml. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  jose: Improper Verification of Cryptographic Signature

  CVE-2026-89086Sep 10, 2026OCaml

  In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.