Is CVE-2026-89086 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-89086?

CVE-2026-89086 has a CVSS v3 severity of CRITICAL (9.1).

Back

CVE-2026-89086

Description

In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.