What is GHSA-9r5j-37q2-cffw?

GHSA-9r5j-37q2-cffw is a security advisory published by GitHub Security Advisories with Critical severity. In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only...

Which CVE IDs does GHSA-9r5j-37q2-cffw cover?

GHSA-9r5j-37q2-cffw covers the following CVE IDs: CVE-2026-89086. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9r5j-37q2-cffw?

GHSA-9r5j-37q2-cffw has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

GHSA-9r5j-37q2-cffwCriticalCVSS 9.1

In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only...

Vendor

GitHub Security Advisories

Published

September 10, 2026

Last Modified

September 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-89086 →

📋 Description

In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-89086
https://github.com/ulrikstrid/ocaml-jose/commit/cf17d991ec6a0d1997956b6c7799890f9c28879e
https://osv.dev/vulnerability/OSEC-2026-19
https://github.com/advisories/GHSA-9r5j-37q2-cffw