Skip to content
OpenAdvisories

Package · Go

github.com/sigstore/sigstore-go

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 3.1
    CVE-2026-54787

    sigstore-go fails to check signature timestamps against a signing key's validity period

    sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which …

    sigstore sigstore-go zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  • Low 3.1
    CVE-2024-45395

    Unbounded loop over untrusted input can lead to endless data attack

    sigstore-go, a Go library for Sigstore signing and verification, is susceptible to a denial of service attack in versions prior to 0.6.1 when a verifier is provided a maliciously crafted Sigstore Bundle containing large amounts of verifiable data, in the form…

    sigstore sigstore-go slsa-verifier gh Wolfi Go