Ssigstore

Products

Exploited and recent CVEs

• CVE-2026-118763 High 7.4 @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location 0.3%
• CVE-2026-48702 High 7.5 Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic 0.5%
• CVE-2026-49478 High 8.7 Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage 0.3%
• CVE-2026-48791 Low 2.0 Sigstore Java has a vulnerability with bundle verification of integratedTime <0.1%
• CVE-2026-54787 Low 3.1 sigstore-go fails to check signature timestamps against a signing key's validity period 0.1%
• CVE-2026-49834 Medium 5.9 sigstore-go: Multi-log threshold bypass via single compromised log 0.2%
• CVE-2026-49835 Medium 5.9 Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality 0.7%
• CVE-2026-48816 Medium 6.5 sigstore-js: Insufficient Verification of Data Authenticity 0.1%
• CVE-2026-48758 Medium 5.4 sigstore-js: DSSE payloadType type-binding failure 0.2%
• CVE-2026-48815 High 7.5 sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced 0.2%
• CVE-2026-59891 Critical 9.6 Credential confusion in  @sigstore/oci  can leak registry credentials to an attacker-controlled registry 0.5%
• CVE-2026-44309 Medium 5.3 gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits 0.1%
• CVE-2026-44310 Medium 5.4 gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers 0.1%
• CVE-2026-39984 Medium 5.5 Sigstore Timestamp Authority has Improper Certificate Validation in verifier <0.1%
• CVE-2026-39395 Medium 4.3 Cosign's verify-blob-attestation reports false positive when payload parsing fails 0.2%
• CVE-2026-31830 High 7.5 sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest 0.3%
• CVE-2026-24122 Low 3.7 Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked 0.2%
• CVE-2026-24408 None 0.0 sigstore has CSRF possibility in OIDC authentication during signing 0.2%
• CVE-2026-24137 Medium 5.8 sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal 0.4%
• CVE-2026-24117 Medium 5.3 Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL 0.4%
• CVE-2026-23831 Medium 5.3 Rekor COSE v0.0.1 Canonicalize crashes when passed empty Message 0.4%
• CVE-2026-22772 Medium 5.8 Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass 0.2%
• CVE-2026-22703 Medium 5.5 Cosign verification accepts any valid Rekor entry under certain conditions 0.1%
• CVE-2025-66564 High 7.5 Sigstore Timestamp Authority allocates excessive memory during request parsing 0.5%
• CVE-2025-66506 High 7.5 Fulcio allocates excessive memory during token parsing 0.2%
• CVE-2024-55655 Low 2.7 sigstore-python has insufficient validation of integration timestamp during verification 0.3%
• CVE-2024-54140 Low 2.1 sigstore-java has a vulnerability with bundle verification 0.2%
• CVE-2024-53267 Medium 5.5 Vulnerability with bundle verification in sigstore-java <0.1%
• CVE-2024-51746 Low 1.8 Use of incorrect Rekor entries during verification in gitsign 0.1%
• CVE-2024-45395 Low 3.1 Unbounded loop over untrusted input can lead to endless data attack 0.5%