CVE-2026-89317 Eclipse Foundation CVE debrief

Who should care

Defenders and security teams should be aware of this vulnerability and assess their exposure. They should prioritize verifying the presence of this vulnerability in their systems and assessing the potential impact due to improper handling of JWS `crit` headers. This includes reviewing system configurations, checking for patches or updates, and implementing compensating controls if necessary.

Why it matters

Defenders should prioritize verifying the presence of this vulnerability in their systems and assessing the potential impact due to improper handling of JWS `crit` headers.

• Verification of system vulnerability to JWS `crit` header exploitation
• Potential security risks due to improper handling of JWS `crit` headers

Technical summary

gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected — and none were. This vulnerability affects systems using gose for JWS handling and could lead to security risks if not properly addressed. The vulnerability has a CVSS score of 6.3 and is classified as MEDIUM severity.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their systems and assessing the potential impact.

Recommended defensive actions

• Verify the presence of this vulnerability in your systems
• Assess the potential impact of this vulnerability
• Check for any available patches or updates
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, but further verification is needed to determine the extent of the issue. The vulnerability is caused by gose parsing the JWS `crit` header into `JwsHeader.Crit` and then never reading it, which is a security risk according to RFC 7515 §4.1.11. The CVE record and NVD detail page provide official information, but additional verification is required to assess the vulnerability's impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.