Skip to content
OpenAdvisories

Package · Maven

dev.sigstore:sigstore-java

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Low 2.0
    CVE-2026-48791

    Sigstore Java has a vulnerability with bundle verification of integratedTime

    sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor entry) time) against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancemen…

    sigstore sigstore-java dev.sigstore:sigstore-java golang-github-sigstore-sigstore Ubuntu Maven
  • Low 2.1
    CVE-2024-54140

    sigstore-java has a vulnerability with bundle verification

    sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a bundle provides a invalid signature for a checkpoint. This bug impacts clients using any variation of Key…

    sigstore sigstore-java dev.sigstore:sigstore-java Maven
  • Medium 5.5
    CVE-2024-53267

    Vulnerability with bundle verification in sigstore-java

    sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a validly-signed but "mismatched" bundle is presented as proof of inclusion into a transparency log. This b…

    sigstore sigstore-java dev.sigstore:sigstore-java Maven