Description (CNA)
gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected — and none were.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Eclipse Foundation / Eclipse KeyPont - GOSE | affected 0.7.3 through 0.13.0-rc1 |
| Eclipse Foundation / Eclipse KeyPont - GOSE | affected 0 before 1.0.0-rc4 |
CWE
CWE-20, CWE-347, CWE-1288