CVE-2026-89086

CriticalCVSS 9.1/10Last modified Sep 22, 2026

Description

In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
OCaml	jose	< 0.11.0

References

Timeline

Published: Sep 10, 2026
Last modified: Sep 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-890877.3The cstruct package before 6.3.0 for OCaml mishandles indexes.CVE-2026-890885.5A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By co CVE-2026-890896.5A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A lo CVE-2026-89094.3The WpMobi plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.0.3. This is due to miss CVE-2026-890905.9An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated CVE-2026-890918.8A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates mem CVE-2026-890924.2The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a respo CVE-2026-890935.3The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by CVE-2026-890949.9Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/templat CVE-2026-890965.9A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notificati CVE-2026-890974.3The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and i CVE-2026-890985.5A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program asserti