Skip to content
OpenAdvisories

Product · sigstore

sigstore-java

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 2.0
    CVE-2026-48791

    Sigstore Java has a vulnerability with bundle verification of integratedTime

    sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor entry) time) against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancemen…

    sigstore sigstore-java dev.sigstore:sigstore-java golang-github-sigstore-sigstore Ubuntu Maven
  • Low 2.1
    CVE-2024-54140

    sigstore-java has a vulnerability with bundle verification

    sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a bundle provides a invalid signature for a checkpoint. This bug impacts clients using any variation of Key…

    sigstore sigstore-java dev.sigstore:sigstore-java Maven