CVE-2026-89086

In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS 1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key...

PT-2026-89582

Name of the Vulnerable Software and Affected Versions jose versions prior to 0.11.0 Description The jose package for OCaml fails to properly validate RSA signatures. The library only confirms that PKCS 1 decoding succeeds but does not perform the necessary verification steps using the public key,...