sigstore/cosign Security Advisories | GitStock

medium2026-04-08

Cosign's verify-blob-attestation reports false positive when payload parsing fails

GHSA-w6c6-c85g-mmv6 · CVE-2026-39395

low2026-02-19

Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped

GHSA-wfqv-66vq-46rm · CVE-2026-24122

medium2026-01-13

Cosign verification accepts any valid Rekor entry under certain conditions

GHSA-whqx-f9j3-ch6m · CVE-2026-22703

medium2024-04-11

Cosign malicious artifacts can cause machine-wide DoS

GHSA-95pr-fxf5-86gv · CVE-2024-29903

medium2024-04-11

Cosign malicious attachments can cause system-wide denial of service

GHSA-88jx-383q-w4qc · CVE-2024-29902

low2023-11-08

Cosign vulnerable to possible endless data attack from attacker-controlled registry

GHSA-vfp6-jrw2-99g9 · CVE-2023-46737

medium2022-09-16

Cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature

GHSA-8gw7-4j42-w388 · CVE-2022-36056

high2022-08-10

cosign's `cosign verify-attestaton --type` can report a false positive if any attestation exists

GHSA-vjxv-45g9-9296 · CVE-2022-35929

low2022-02-22

Improper Certificate Validation in Cosign

GHSA-ccxc-vr6p-4858 · CVE-2022-23649