github.com/sigstore/cosign/v2 vulnerabilities (Go)

6 vulnerabilities.

• github.com/sigstore/cosign/v2 Go Cosign's verify-blob-attestation reports false positive when payload parsing fails CVE-2026-39395 Fix available 4.3 MediumApril 7, 2026
• github.com/sigstore/cosign/v2 Go Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked CVE-2026-24122 Fix available 3.7 LowFebruary 19, 2026
• github.com/sigstore/cosign/v2 Go Cosign verification accepts any valid Rekor entry under certain conditions CVE-2026-22703 Fix available 5.5 MediumJanuary 10, 2026
• github.com/sigstore/cosign/v2 Go Cosign vulnerable to machine-wide denial of service via malicious artifacts CVE-2024-29903 Fix available 4.2 MediumApril 10, 2024
• github.com/sigstore/cosign/v2 Go Cosign vulnerable to system-wide denial of service via malicious attachments CVE-2024-29902 Fix available 4.2 MediumApril 10, 2024
• github.com/sigstore/cosign/v2 Go Possible endless data attack from attacker-controlled registry in cosign CVE-2023-46737 Fix available 3.1 LowNovember 7, 2023