Skip to content
OpenAdvisories

Package · Go

github.com/sigstore/cosign/v2

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-24122

    Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked

    Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp…

    sigstore cosign github.com/sigstore/cosign github.com/sigstore/cosign/v2 Debian Ubuntu Go
  • Low 3.1
    CVE-2023-46737

    Possible endless data attack from attacker-controlled registry in cosign

    Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Co…

    sigstore cosign github.com/sigstore/cosign github.com/sigstore/cosign/v2 Alpine Go