Skip to content
OpenAdvisories

Package · Go

github.com/sigstore/cosign/v3

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-39395

    Cosign's verify-blob-attestation reports false positive when payload parsing fails

    Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign verify-blob-attestation may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-f…

    sigstore cosign github.com/sigstore/cosign github.com/sigstore/cosign/v2 Debian Ubuntu Alpine Go
  • Medium 5.5
    CVE-2026-22703

    Cosign verification accepts any valid Rekor entry under certain conditions

    Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature …

    sigstore cosign github.com/sigstore/cosign cosign Debian Ubuntu Alpine Go