Sigstore vulnerabilities
40 CVEs and advisories name Sigstore as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-118763@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location
- CVE-2026-48702Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic
- CVE-2026-49478Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage
- CVE-2026-48791Sigstore Java has a vulnerability with bundle verification of integratedTime
- CVE-2026-54787sigstore-go fails to check signature timestamps against a signing key's validity period
- CVE-2026-49834sigstore-go: Multi-log threshold bypass via single compromised log
- CVE-2026-49835Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality
- CVE-2026-48816sigstore-js: Insufficient Verification of Data Authenticity
- CVE-2026-48758sigstore-js: DSSE payloadType type-binding failure
- CVE-2026-48815sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced
- CVE-2026-59891Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry
- CVE-2026-44309gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits
- CVE-2026-44310gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers
- CVE-2026-39984Sigstore Timestamp Authority has Improper Certificate Validation in verifier
- CVE-2026-39395Cosign's verify-blob-attestation reports false positive when payload parsing fails
- CVE-2026-31830sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest
- CVE-2026-24122Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked
- CVE-2026-24408sigstore has CSRF possibility in OIDC authentication during signing
- CVE-2026-24137sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal
- CVE-2026-24117Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL
- CVE-2026-23831Rekor COSE v0.0.1 Canonicalize crashes when passed empty Message
- CVE-2026-22772Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass
- CVE-2026-22703Cosign verification accepts any valid Rekor entry under certain conditions
- CVE-2025-66564Sigstore Timestamp Authority allocates excessive memory during request parsing
- CVE-2025-66506Fulcio allocates excessive memory during token parsing
- CVE-2024-55655sigstore-python has insufficient validation of integration timestamp during verification
- CVE-2024-54140sigstore-java has a vulnerability with bundle verification
- CVE-2024-53267Vulnerability with bundle verification in sigstore-java
- CVE-2024-51746Use of incorrect Rekor entries during verification in gitsign
- CVE-2024-45395Unbounded loop over untrusted input can lead to endless data attack