Skip to content
OpenAdvisories

Product · sigstore

sigstore-ruby

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2026-31830

    sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest

    sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project. Prior to 0.2.3, Sigstore::Verifier#verify does not propagate the VerificationFailure returned by verify_in_toto when the artifact digest does not matc…

    sigstore sigstore-ruby sigstore RubyGems