Skip to content
OpenAdvisories

Package · Go

github.com/sigstore/sigstore-go

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Low 3.1
    CVE-2026-54787

    sigstore-go fails to check signature timestamps against a signing key's validity period

    sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which …

    sigstore sigstore-go github.com/sigstore/sigstore-go sigstore-go Debian Ubuntu Go
  • Medium 5.9
    CVE-2026-49834

    sigstore-go: Multi-log threshold bypass via single compromised log

    sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) counts verified witnesses per entry or per validation path rather than per log autho…

    sigstore sigstore-go github.com/sigstore/sigstore-go sigstore-go Debian Ubuntu Go
  • Low 3.1
    CVE-2024-45395

    Unbounded loop over untrusted input can lead to endless data attack

    sigstore-go, a Go library for Sigstore signing and verification, is susceptible to a denial of service attack in versions prior to 0.6.1 when a verifier is provided a maliciously crafted Sigstore Bundle containing large amounts of verifiable data, in the form…

    sigstore sigstore-go github.com/sigstore/sigstore-go Go