sigstore-go vulnerabilities

2 known vulnerabilities in sigstore-go from Sigstore. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  sigstore-go: Improper Verification of Cryptographic Signature

  CVE-2026-49834Jul 17, 2026Sigstore

  sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) counts verified witnesses per entry or per validation path rather than per log author

• 7.5 High severity

  sigstore-go: Loop with Unreachable Exit Condition

  CVE-2024-45395Sep 4, 2024Sigstore

  sigstore-go, a Go library for Sigstore signing and verification, is susceptible to a denial of service attack in versions prior to 0.6.1 when a verifier is provided a maliciously crafted Sigstore Bundle containing large amounts of verifiable data, in the form