sigstore/sigstore-go Security Advisories | GitStock

low2026-07-31

sigstore-go fails to check signature timestamps against a signing key's validity period

GHSA-wqqc-jjcq-vfxm · CVE-2026-54787

medium2026-07-09

sigstore-go has a multi-log threshold bypass via single compromised log

GHSA-9vcr-p3rj-q5q6 · CVE-2026-49834

low2024-09-04

sigstore-go has an unbounded loop over untrusted input can lead to endless data attack

GHSA-cq38-jh5f-37mq · CVE-2024-45395