CVE-2026-89086
The OCaml jose library before version 0.11.0 incorrectly validates RSA signatures, accepting any signature that can be decoded with PKCS #1. This flaw allows attackers to forge signatures without needing the public key, potentially leading to unauthorized actions.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
The OCaml jose library, versions prior to 0.11.0. Any application that uses this library for RSA signature verification is affected.
Real-world impact
An attacker could forge a signature and trick the application into accepting malicious data, enabling unauthorized operations or data tampering.
Why this severity
The CVSS score of 9.1 reflects that the flaw is network‑exploitable with no authentication or user interaction, and it completely compromises confidentiality and integrity of protected data.
What to do about it
- 01Upgrade the jose OCaml library to version 0.11.0 or later.
- 02Restart any services or applications that use the jose library.
NVD description indicates fix in version 0.11.0
Timeline
- Sep 10, 2026 · 3d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 10, 2026 · 3d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.