[ CVE-2026-89317 · Published 23 Oct 2026 ]
Vulnerability in Eclipse Foundation Eclipse KeyPont - GOSE
CVSS 6.3
EPSS <1%No fix listed yet
[ Description ]Official description
gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected — and none were.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.