Skip to content
OpenAdvisories

Package · Debian

sigstore-go

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Low 3.1
    CVE-2026-54787

    sigstore-go fails to check signature timestamps against a signing key's validity period

    sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which …

    sigstore sigstore-go zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  • Medium 5.9
    CVE-2026-49834

    sigstore-go: Multi-log threshold bypass via single compromised log

    sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) counts verified witnesses per entry or per validation path rather than per log autho…

    sigstore sigstore-go kubescape zarf Debian Ubuntu Wolfi Go