---
id: CVE-2026-89317
title: >-
  JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515
  §4.1.11)
summary: >-
  gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read
  it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed
  critical extension parameters it does not understand. gose implements no
  header extensions…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-20
  - CWE-347
  - CWE-1288
vendor: Eclipse Foundation
product: github.com/ThalesGroup/gose
affected:
  - github.com/ThalesGroup/gose >= 0.7.3 <= 0.13.0-rc1
  - github.com/eclipse-keypont/gose < 1.0.0-rc4
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T08:50:22.987Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89317'
references:
  - url: >-
      https://github.com/eclipse-keypont/gose/security/advisories/GHSA-445r-fpvv-hgwc
tags:
  - cve.org
ingestedAt: '2026-10-23T09:20:44.058Z'
---

## Overview

gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected — and none were.

## Affected

- `github.com/ThalesGroup/gose >= 0.7.3 <= 0.13.0-rc1`
- `github.com/eclipse-keypont/gose < 1.0.0-rc4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.