github.com/sigstore/cosign vulnerabilities (Go)

9 vulnerabilities.

• github.com/sigstore/cosign Go Cosign's verify-blob-attestation reports false positive when payload parsing fails CVE-2026-39395 Fix available 4.3 MediumApril 7, 2026
• github.com/sigstore/cosign Go Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked CVE-2026-24122 Fix available 3.7 LowFebruary 19, 2026
• github.com/sigstore/cosign Go Cosign verification accepts any valid Rekor entry under certain conditions CVE-2026-22703 Fix available 5.5 MediumJanuary 10, 2026
• github.com/sigstore/cosign Go Cosign vulnerable to machine-wide denial of service via malicious artifacts CVE-2024-29903 Fix available 4.2 MediumApril 10, 2024
• github.com/sigstore/cosign Go Cosign vulnerable to system-wide denial of service via malicious attachments CVE-2024-29902 Fix available 4.2 MediumApril 10, 2024
• github.com/sigstore/cosign Go Possible endless data attack from attacker-controlled registry in cosign CVE-2023-46737 Fix available 3.1 LowNovember 7, 2023
• github.com/sigstore/cosign Go Vulnerabilities with blob verification in sigstore cosign CVE-2022-36056 Fix available 5.5 MediumSeptember 14, 2022
• github.com/sigstore/cosign Go False positive signature verification in cosign CVE-2022-35929 Fix available 7.1 HighAugust 4, 2022
• github.com/sigstore/cosign Go Improper Certificate Validation in Cosign CVE-2022-23649 Fix available 3.3 LowFebruary 18, 2022