sigstore

Records40All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high13CVSS 7.0–8.9

Exploited now

sigstore records in CISA KEV

No sigstore vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Cosign 9 records HIGH Sigstore-go 2 records LOW Gitsign 1 record LOW Policy Controller 1 record MEDIUM Sigstore 1 record LOW

Records

2 records in Sigstore-go · all components

TI-2024-30444 CVE-2024-45395 · GHSA-cq38-jh5f-37mq

Unbounded loop over untrusted input can lead to endless data attack

LOW 33

sigstore-go, a Go library for Sigstore signing and verification, is susceptible to a denial of service attack in versions prior to 0.6.1 when a verifier is provided a maliciously crafted Sigstore Bundle containing large…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00468 Published 2024-09-04 Fixed in 0.6.1 CWE-835

TI-2026-36738 CVE-2026-49834 · GHSA-9vcr-p3rj-q5q6

sigstore-go: Multi-log threshold bypass via single compromised log

LOW 32

sigstore-go is a Go library for Sigstore signing and verification.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00181 Published 2026-07-17 Partial fix · 1.2.0 CWE-347

Open these records in search →

Critical	2
High	13
Medium	18
Low	7
No CVSS	0