Skip to content
OpenAdvisories

Package · Go

github.com/sigstore/cosign/v3

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 4.3
    CVE-2026-39395

    Cosign's verify-blob-attestation reports false positive when payload parsing fails

    Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign verify-blob-attestation may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-f…

    sigstore cosign github.com/sigstore/cosign cosign Debian Ubuntu Alpine Go
  • Low 3.7
    CVE-2026-24122

    Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked

    Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp…

    sigstore cosign github.com/sigstore/cosign github.com/sigstore/cosign/v2 Debian Ubuntu Go
  • Medium 5.5
    CVE-2026-22703

    Cosign verification accepts any valid Rekor entry under certain conditions

    Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature …

    sigstore cosign github.com/sigstore/cosign cosign Debian Ubuntu Alpine Go