github.com/sigstore/cosign/v3 vulnerabilities (Go)

3 vulnerabilities.

• github.com/sigstore/cosign/v3 Go Cosign's verify-blob-attestation reports false positive when payload parsing fails CVE-2026-39395 Fix available 4.3 MediumApril 7, 2026
• github.com/sigstore/cosign/v3 Go Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked CVE-2026-24122 Fix available 3.7 LowFebruary 19, 2026
• github.com/sigstore/cosign/v3 Go Cosign verification accepts any valid Rekor entry under certain conditions CVE-2026-22703 Fix available 5.5 MediumJanuary 10, 2026