Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1

Export CSV
CVE-2026-89086

Incomplete RSA Signature Validation in OCaml jose Before 0.11.0

In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Ocaml
Products
Jose