Skip to content
OpenAdvisories

Package · Go

github.com/sigstore/cosign

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-24122

    Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked

    Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp…

    sigstore cosign github.com/sigstore/cosign github.com/sigstore/cosign/v2 Debian Ubuntu Go
  • Low 3.1
    CVE-2023-46737

    Possible endless data attack from attacker-controlled registry in cosign

    Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Co…

    sigstore cosign github.com/sigstore/cosign github.com/sigstore/cosign/v2 Alpine Go
  • Low 3.3
    CVE-2022-23649

    Improper Certificate Validation in Cosign

    Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This re…

    sigstore cosign github.com/sigstore/cosign cosign Alpine Go