Vulnerability · Published May 15, 2026 · Assigned by GitHub_M
CVE-2026-44309gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits
Medium 5.3
In plain English
A medium-severity improper certificate validation in gitsign from sigstore. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. Prior to 0.16.0, gitsign verify and gitsign verify-tag re-encode commit/tag objects through go-git's EncodeWithoutSignature before checking the signature, instead of verifying against the raw git object bytes. For malformed objects with duplicate tree headers, git-core and go-git parse different trees: git-core uses the first, go-git uses the second. A signature crafted over the go-git-normalized form (second tree) passes gitsign verify while git-core resolves the commit to a completely different tree. This breaks the invariant that a verified signature, the commit semantics git-core presents to users, and the object hash logged in Rekor all refer to the same content. This vulnerability is fixed in 0.16.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | gitsign | no fix listed | DEBIAN-CVE-2026-44309 |
| Debian:14 | gitsign | 0.16.0-1 | DEBIAN-CVE-2026-44309 |
| Go | github.com/sigstore/gitsign | 0.16.0 | GHSA-7rmh-48mx-2vwc |
| Go | github.com/sigstore/gitsign | 0.16.0 | GO-2026-5233 |
| Ubuntu:25.10 | gitsign | no fix listed | UBUNTU-CVE-2026-44309 |
| Ubuntu:26.10 | gitsign | no fix listed | UBUNTU-CVE-2026-44309 |
Affected products (as reported)
Weakness: CWE-347, CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
References
- https://github.com/sigstore/gitsign/security/advisories/GHSA-7rmh-48mx-2vwc x_refsource_CONFIRM