Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-2560

NIXPKGS-2026-2560
published 4 hours ago
In the jose package before 0.11.0 for OCaml, library calls …
Permalink CVE-2026-89086
9.1 CRITICAL
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 4 hours ago by @LeSuisse Activity log
  • Created suggestion 8 hours ago
  • @LeSuisse ignored
    14 packages
    • cjose
    • jose
    • haskellPackages.jose
    • haskellPackages.jose-jwt
    • python313Packages.djoser
    • python313Packages.josepy
    • python314Packages.djoser
    • python314Packages.josepy
    • ocamlPackages_latest.jose
    • python313Packages.joserfc
    • python314Packages.joserfc
    • python313Packages.python-jose
    • python314Packages.python-jose
    • home-assistant-custom-components.calendar_export
    4 hours ago
  • @LeSuisse restored package ocamlPackages_latest.jose 4 hours ago
  • @LeSuisse accepted 4 hours ago
  • @LeSuisse published on GitHub 4 hours ago
In the jose package before 0.11.0 for OCaml, library calls …

In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.

Affected products

jose
  • <0.11.0

Matching in nixpkgs

Ignored packages (13)

pkgs.jose

C-language implementation of Javascript Object Signing and Encryption

  • nixos-unstable 14
    • nixpkgs-unstable 14
    • nixos-unstable-small 14
  • nixos-26.05 14
    • nixos-26.05-small 14
    • nixpkgs-26.05-darwin 14

pkgs.cjose

C library for Javascript Object Signing and Encryption. This is a maintained fork of the original project

pkgs.haskellPackages.jose

JSON Object Signing and Encryption (JOSE) and JSON Web Token (JWT) library

  • nixos-unstable 0.11
    • nixpkgs-unstable 0.11
    • nixos-unstable-small 0.11
  • nixos-26.05 0.11
    • nixos-26.05-small 0.11
    • nixpkgs-26.05-darwin 0.11

Package maintainers