Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/sigstore/sigstore-go

3 known vulnerabilities (1 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3 · 1 medium, 2 low
Registry
pkg.go.dev

Advisories 3

  • sigstore-go fails to check signature timestamps against a signing key's validity period

    Affected: fixed in 1.2.1.

  • CVE-2026-49834Medium 5.9

    sigstore-go: Multi-log threshold bypass via single compromised log

    Affected: fixed in 1.2.0.

  • Unbounded loop over untrusted input can lead to endless data attack

    Affected: fixed in 0.6.1.