TI-2026-24383 CVE-2026-31830 · GHSA-mhg6-2q2v-9h2c
sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest
Priority LOW 39
sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project.