Skip to content
OpenAdvisories

Package · Alpine

cosign

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-39395

    Cosign's verify-blob-attestation reports false positive when payload parsing fails

    Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign verify-blob-attestation may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-f…

    sigstore cosign github.com/sigstore/cosign github.com/sigstore/cosign/v2 Debian Ubuntu Alpine Go
  • Medium 5.5
    CVE-2026-22703

    Cosign verification accepts any valid Rekor entry under certain conditions

    Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature …

    sigstore cosign github.com/sigstore/cosign cosign Debian Ubuntu Alpine Go
  • Medium 5.5
    CVE-2022-36056

    Vulnerabilities with blob verification in sigstore cosign

    Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when …

    sigstore cosign github.com/sigstore/cosign cosign Alpine Go