github.com/sigstore/cosign
Code signing and transparency for containers and binaries
View on Github
Activity
- Latest release
- 2y ago
- Total releases
- 20
- Cadence
- ~13 days
- Last 12 months
- 0
Reach
- Stars
- 6.2k
Details
- First release
- Mar 03, 2022
| Version | Released | |
|---|---|---|
v1.13.6
patch
6 CVEs
CVE-2026-39395
GO-2026-5694
BIT-cosign-2026-39395
GHSA-w6c6-c85g-mmv6
Jun 25, 2026
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign References Updated Jun 27, 2026 · Source: OSV.dev
CVE-2026-24122
GO-2026-4529
BIT-cosign-2026-24122
GHSA-wfqv-66vq-46rm
Feb 23, 2026
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign References Updated Jun 16, 2026 · Source: OSV.dev
CVE-2026-22703
GO-2026-4309
BIT-cosign-2026-22703
GHSA-whqx-f9j3-ch6m
Jan 13, 2026
Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign References Updated Aug 24, 2026 · Source: OSV.dev
CVE-2024-29902
GO-2024-2718
BIT-cosign-2024-29902
GHSA-88jx-383q-w4qc
Jun 05, 2024
Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-29903
GO-2024-2719
BIT-cosign-2024-29903
GHSA-95pr-fxf5-86gv
Jun 05, 2024
Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-46737
GO-2023-2181
BIT-cosign-2023-46737
GHSA-vfp6-jrw2-99g9
Nov 09, 2023
Denial of service attack from remote registry in github.com/sigstore/cosign An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack. References Updated Feb 04, 2026 · Source: OSV.dev |
v1.13.6
patch
Dependencies (47)
+ 39 more |
|
v1.13.5
patch
6 CVEs
CVE-2026-39395
GO-2026-5694
BIT-cosign-2026-39395
GHSA-w6c6-c85g-mmv6
Jun 25, 2026
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign References Updated Jun 27, 2026 · Source: OSV.dev
CVE-2026-24122
GO-2026-4529
BIT-cosign-2026-24122
GHSA-wfqv-66vq-46rm
Feb 23, 2026
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign References Updated Jun 16, 2026 · Source: OSV.dev
CVE-2026-22703
GO-2026-4309
BIT-cosign-2026-22703
GHSA-whqx-f9j3-ch6m
Jan 13, 2026
Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign References Updated Aug 24, 2026 · Source: OSV.dev
CVE-2024-29902
GO-2024-2718
BIT-cosign-2024-29902
GHSA-88jx-383q-w4qc
Jun 05, 2024
Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-29903
GO-2024-2719
BIT-cosign-2024-29903
GHSA-95pr-fxf5-86gv
Jun 05, 2024
Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-46737
GO-2023-2181
BIT-cosign-2023-46737
GHSA-vfp6-jrw2-99g9
Nov 09, 2023
Denial of service attack from remote registry in github.com/sigstore/cosign An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack. References Updated Feb 04, 2026 · Source: OSV.dev |
v1.13.5
patch
Dependencies (47)
+ 39 more |
|
v1.13.4
patch
6 CVEs
CVE-2026-39395
GO-2026-5694
BIT-cosign-2026-39395
GHSA-w6c6-c85g-mmv6
Jun 25, 2026
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign References Updated Jun 27, 2026 · Source: OSV.dev
CVE-2026-24122
GO-2026-4529
BIT-cosign-2026-24122
GHSA-wfqv-66vq-46rm
Feb 23, 2026
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign References Updated Jun 16, 2026 · Source: OSV.dev
CVE-2026-22703
GO-2026-4309
BIT-cosign-2026-22703
GHSA-whqx-f9j3-ch6m
Jan 13, 2026
Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign References Updated Aug 24, 2026 · Source: OSV.dev
CVE-2024-29902
GO-2024-2718
BIT-cosign-2024-29902
GHSA-88jx-383q-w4qc
Jun 05, 2024
Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-29903
GO-2024-2719
BIT-cosign-2024-29903
GHSA-95pr-fxf5-86gv
Jun 05, 2024
Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-46737
GO-2023-2181
BIT-cosign-2023-46737
GHSA-vfp6-jrw2-99g9
Nov 09, 2023
Denial of service attack from remote registry in github.com/sigstore/cosign An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack. References Updated Feb 04, 2026 · Source: OSV.dev |
v1.13.4
patch
Dependencies (47)
+ 39 more |
|
v1.13.3
patch
6 CVEs
CVE-2026-39395
GO-2026-5694
BIT-cosign-2026-39395
GHSA-w6c6-c85g-mmv6
Jun 25, 2026
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign References Updated Jun 27, 2026 · Source: OSV.dev
CVE-2026-24122
GO-2026-4529
BIT-cosign-2026-24122
GHSA-wfqv-66vq-46rm
Feb 23, 2026
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign References Updated Jun 16, 2026 · Source: OSV.dev
CVE-2026-22703
GO-2026-4309
BIT-cosign-2026-22703
GHSA-whqx-f9j3-ch6m
Jan 13, 2026
Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign References Updated Aug 24, 2026 · Source: OSV.dev
CVE-2024-29902
GO-2024-2718
BIT-cosign-2024-29902
GHSA-88jx-383q-w4qc
Jun 05, 2024
Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-29903
GO-2024-2719
BIT-cosign-2024-29903
GHSA-95pr-fxf5-86gv
Jun 05, 2024
Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-46737
GO-2023-2181
BIT-cosign-2023-46737
GHSA-vfp6-jrw2-99g9
Nov 09, 2023
Denial of service attack from remote registry in github.com/sigstore/cosign An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack. References Updated Feb 04, 2026 · Source: OSV.dev |
v1.13.3
patch
Dependencies (47)
+ 39 more |
|
v1.13.2
patch
6 CVEs
CVE-2026-39395
GO-2026-5694
BIT-cosign-2026-39395
GHSA-w6c6-c85g-mmv6
Jun 25, 2026
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign References Updated Jun 27, 2026 · Source: OSV.dev
CVE-2026-24122
GO-2026-4529
BIT-cosign-2026-24122
GHSA-wfqv-66vq-46rm
Feb 23, 2026
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign References Updated Jun 16, 2026 · Source: OSV.dev
CVE-2026-22703
GO-2026-4309
BIT-cosign-2026-22703
GHSA-whqx-f9j3-ch6m
Jan 13, 2026
Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign References Updated Aug 24, 2026 · Source: OSV.dev
CVE-2024-29902
GO-2024-2718
BIT-cosign-2024-29902
GHSA-88jx-383q-w4qc
Jun 05, 2024
Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-29903
GO-2024-2719
BIT-cosign-2024-29903
GHSA-95pr-fxf5-86gv
Jun 05, 2024
Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-46737
GO-2023-2181
BIT-cosign-2023-46737
GHSA-vfp6-jrw2-99g9
Nov 09, 2023
Denial of service attack from remote registry in github.com/sigstore/cosign An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack. References Updated Feb 04, 2026 · Source: OSV.dev |
v1.13.2
patch
Dependencies (44)
+ 36 more |
|
v1.13.1
patch
6 CVEs
CVE-2026-39395
GO-2026-5694
BIT-cosign-2026-39395
GHSA-w6c6-c85g-mmv6
Jun 25, 2026
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign References Updated Jun 27, 2026 · Source: OSV.dev
CVE-2026-24122
GO-2026-4529
BIT-cosign-2026-24122
GHSA-wfqv-66vq-46rm
Feb 23, 2026
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign References Updated Jun 16, 2026 · Source: OSV.dev
CVE-2026-22703
GO-2026-4309
BIT-cosign-2026-22703
GHSA-whqx-f9j3-ch6m
Jan 13, 2026
Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign References Updated Aug 24, 2026 · Source: OSV.dev
CVE-2024-29902
GO-2024-2718
BIT-cosign-2024-29902
GHSA-88jx-383q-w4qc
Jun 05, 2024
Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-29903
GO-2024-2719
BIT-cosign-2024-29903
GHSA-95pr-fxf5-86gv
Jun 05, 2024
Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-46737
GO-2023-2181
BIT-cosign-2023-46737
GHSA-vfp6-jrw2-99g9
Nov 09, 2023
Denial of service attack from remote registry in github.com/sigstore/cosign An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack. References Updated Feb 04, 2026 · Source: OSV.dev |
v1.13.1
patch
Dependencies (44)
+ 36 more |
|
v1.13.0
minor
6 CVEs
CVE-2026-39395
GO-2026-5694
BIT-cosign-2026-39395
GHSA-w6c6-c85g-mmv6
Jun 25, 2026
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign References Updated Jun 27, 2026 · Source: OSV.dev
CVE-2026-24122
GO-2026-4529
BIT-cosign-2026-24122
GHSA-wfqv-66vq-46rm
Feb 23, 2026
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign References Updated Jun 16, 2026 · Source: OSV.dev
CVE-2026-22703
GO-2026-4309
BIT-cosign-2026-22703
GHSA-whqx-f9j3-ch6m
Jan 13, 2026
Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign References Updated Aug 24, 2026 · Source: OSV.dev
CVE-2024-29902
GO-2024-2718
BIT-cosign-2024-29902
GHSA-88jx-383q-w4qc
Jun 05, 2024
Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-29903
GO-2024-2719
BIT-cosign-2024-29903
GHSA-95pr-fxf5-86gv
Jun 05, 2024
Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-46737
GO-2023-2181
BIT-cosign-2023-46737
GHSA-vfp6-jrw2-99g9
Nov 09, 2023
Denial of service attack from remote registry in github.com/sigstore/cosign An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack. References Updated Feb 04, 2026 · Source: OSV.dev |
v1.13.0
minor
Dependencies (43)
+ 35 more |
|
v1.12.1
patch
6 CVEs
CVE-2026-39395
GO-2026-5694
BIT-cosign-2026-39395
GHSA-w6c6-c85g-mmv6
Jun 25, 2026
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign References Updated Jun 27, 2026 · Source: OSV.dev
CVE-2026-24122
GO-2026-4529
BIT-cosign-2026-24122
GHSA-wfqv-66vq-46rm
Feb 23, 2026
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign References Updated Jun 16, 2026 · Source: OSV.dev
CVE-2026-22703
GO-2026-4309
BIT-cosign-2026-22703
GHSA-whqx-f9j3-ch6m
Jan 13, 2026
Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign References Updated Aug 24, 2026 · Source: OSV.dev
CVE-2024-29902
GO-2024-2718
BIT-cosign-2024-29902
GHSA-88jx-383q-w4qc
Jun 05, 2024
Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-29903
GO-2024-2719
BIT-cosign-2024-29903
GHSA-95pr-fxf5-86gv
Jun 05, 2024
Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-46737
GO-2023-2181
BIT-cosign-2023-46737
GHSA-vfp6-jrw2-99g9
Nov 09, 2023
Denial of service attack from remote registry in github.com/sigstore/cosign An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack. References Updated Feb 04, 2026 · Source: OSV.dev |
v1.12.1
patch
Dependencies (43)
+ 35 more |
|
v1.12.0
minor
6 CVEs
CVE-2026-39395
GO-2026-5694
BIT-cosign-2026-39395
GHSA-w6c6-c85g-mmv6
Jun 25, 2026
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign References Updated Jun 27, 2026 · Source: OSV.dev
CVE-2026-24122
GO-2026-4529
BIT-cosign-2026-24122
GHSA-wfqv-66vq-46rm
Feb 23, 2026
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign References Updated Jun 16, 2026 · Source: OSV.dev
CVE-2026-22703
GO-2026-4309
BIT-cosign-2026-22703
GHSA-whqx-f9j3-ch6m
Jan 13, 2026
Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign References Updated Aug 24, 2026 · Source: OSV.dev
CVE-2024-29902
GO-2024-2718
BIT-cosign-2024-29902
GHSA-88jx-383q-w4qc
Jun 05, 2024
Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-29903
GO-2024-2719
BIT-cosign-2024-29903
GHSA-95pr-fxf5-86gv
Jun 05, 2024
Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-46737
GO-2023-2181
BIT-cosign-2023-46737
GHSA-vfp6-jrw2-99g9
Nov 09, 2023
Denial of service attack from remote registry in github.com/sigstore/cosign An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack. References Updated Feb 04, 2026 · Source: OSV.dev |
v1.12.0
minor
Dependencies (43)
+ 35 more |
|
v1.11.1
patch
7 CVEs
CVE-2026-39395
GO-2026-5694
BIT-cosign-2026-39395
GHSA-w6c6-c85g-mmv6
Jun 25, 2026
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign References Updated Jun 27, 2026 · Source: OSV.dev
CVE-2026-24122
GO-2026-4529
BIT-cosign-2026-24122
GHSA-wfqv-66vq-46rm
Feb 23, 2026
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign References Updated Jun 16, 2026 · Source: OSV.dev
CVE-2026-22703
GO-2026-4309
BIT-cosign-2026-22703
GHSA-whqx-f9j3-ch6m
Jan 13, 2026
Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign References Updated Aug 24, 2026 · Source: OSV.dev
CVE-2024-29902
GO-2024-2718
BIT-cosign-2024-29902
GHSA-88jx-383q-w4qc
Jun 05, 2024
Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-29903
GO-2024-2719
BIT-cosign-2024-29903
GHSA-95pr-fxf5-86gv
Jun 05, 2024
Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-36056
GO-2022-0998
BIT-cosign-2022-36056
GHSA-8gw7-4j42-w388
Nov 09, 2023
Improper blob verification in github.com/sigstore/cosign Improper blob verification in github.com/sigstore/cosign Fixed in
1.12.0
References Updated May 20, 2024 · Source: OSV.dev
CVE-2023-46737
GO-2023-2181
BIT-cosign-2023-46737
GHSA-vfp6-jrw2-99g9
Nov 09, 2023
Denial of service attack from remote registry in github.com/sigstore/cosign An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack. References Updated Feb 04, 2026 · Source: OSV.dev |
v1.11.1
patch
Dependencies (42)
+ 34 more |
|
v1.11.0
minor
7 CVEs
CVE-2026-39395
GO-2026-5694
BIT-cosign-2026-39395
GHSA-w6c6-c85g-mmv6
Jun 25, 2026
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign References Updated Jun 27, 2026 · Source: OSV.dev
CVE-2026-24122
GO-2026-4529
BIT-cosign-2026-24122
GHSA-wfqv-66vq-46rm
Feb 23, 2026
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign References Updated Jun 16, 2026 · Source: OSV.dev
CVE-2026-22703
GO-2026-4309
BIT-cosign-2026-22703
GHSA-whqx-f9j3-ch6m
Jan 13, 2026
Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign References Updated Aug 24, 2026 · Source: OSV.dev
CVE-2024-29902
GO-2024-2718
BIT-cosign-2024-29902
GHSA-88jx-383q-w4qc
Jun 05, 2024
Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-29903
GO-2024-2719
BIT-cosign-2024-29903
GHSA-95pr-fxf5-86gv
Jun 05, 2024
Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-36056
GO-2022-0998
BIT-cosign-2022-36056
GHSA-8gw7-4j42-w388
Nov 09, 2023
Improper blob verification in github.com/sigstore/cosign Improper blob verification in github.com/sigstore/cosign Fixed in
1.12.0
References Updated May 20, 2024 · Source: OSV.dev
CVE-2023-46737
GO-2023-2181
BIT-cosign-2023-46737
GHSA-vfp6-jrw2-99g9
Nov 09, 2023
Denial of service attack from remote registry in github.com/sigstore/cosign An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack. References Updated Feb 04, 2026 · Source: OSV.dev |
v1.11.0
minor
Dependencies (42)
+ 34 more |
|
v1.10.1
patch
7 CVEs
CVE-2026-39395
GO-2026-5694
BIT-cosign-2026-39395
GHSA-w6c6-c85g-mmv6
Jun 25, 2026
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign References Updated Jun 27, 2026 · Source: OSV.dev
CVE-2026-24122
GO-2026-4529
BIT-cosign-2026-24122
GHSA-wfqv-66vq-46rm
Feb 23, 2026
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign References Updated Jun 16, 2026 · Source: OSV.dev
CVE-2026-22703
GO-2026-4309
BIT-cosign-2026-22703
GHSA-whqx-f9j3-ch6m
Jan 13, 2026
Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign References Updated Aug 24, 2026 · Source: OSV.dev
CVE-2024-29902
GO-2024-2718
BIT-cosign-2024-29902
GHSA-88jx-383q-w4qc
Jun 05, 2024
Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-29903
GO-2024-2719
BIT-cosign-2024-29903
GHSA-95pr-fxf5-86gv
Jun 05, 2024
Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-36056
GO-2022-0998
BIT-cosign-2022-36056
GHSA-8gw7-4j42-w388
Nov 09, 2023
Improper blob verification in github.com/sigstore/cosign Improper blob verification in github.com/sigstore/cosign Fixed in
1.12.0
References Updated May 20, 2024 · Source: OSV.dev
CVE-2023-46737
GO-2023-2181
BIT-cosign-2023-46737
GHSA-vfp6-jrw2-99g9
Nov 09, 2023
Denial of service attack from remote registry in github.com/sigstore/cosign An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack. References Updated Feb 04, 2026 · Source: OSV.dev |
v1.10.1
patch
Dependencies (82)
+ 74 more |
|
v1.10.0
minor
8 CVEs
CVE-2026-39395
GO-2026-5694
BIT-cosign-2026-39395
GHSA-w6c6-c85g-mmv6
Jun 25, 2026
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign References Updated Jun 27, 2026 · Source: OSV.dev
CVE-2026-24122
GO-2026-4529
BIT-cosign-2026-24122
GHSA-wfqv-66vq-46rm
Feb 23, 2026
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign References Updated Jun 16, 2026 · Source: OSV.dev
CVE-2026-22703
GO-2026-4309
BIT-cosign-2026-22703
GHSA-whqx-f9j3-ch6m
Jan 13, 2026
Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign References Updated Aug 24, 2026 · Source: OSV.dev
CVE-2024-29902
GO-2024-2718
BIT-cosign-2024-29902
GHSA-88jx-383q-w4qc
Jun 05, 2024
Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-29903
GO-2024-2719
BIT-cosign-2024-29903
GHSA-95pr-fxf5-86gv
Jun 05, 2024
Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-36056
GO-2022-0998
BIT-cosign-2022-36056
GHSA-8gw7-4j42-w388
Nov 09, 2023
Improper blob verification in github.com/sigstore/cosign Improper blob verification in github.com/sigstore/cosign Fixed in
1.12.0
References Updated May 20, 2024 · Source: OSV.dev
CVE-2023-46737
GO-2023-2181
BIT-cosign-2023-46737
GHSA-vfp6-jrw2-99g9
Nov 09, 2023
Denial of service attack from remote registry in github.com/sigstore/cosign An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack. References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-35929
GO-2022-0758
BIT-cosign-2022-35929
GHSA-vjxv-45g9-9296
Nov 09, 2023
Improper verification of signature attestations in github.com/sigstore/cosign Improper verification of signature attestations in github.com/sigstore/cosign Fixed in
1.10.1
References Updated May 20, 2024 · Source: OSV.dev |
v1.10.0
minor
Dependencies (81)
+ 73 more |
|
v1.10.0-rc.1
pre
8 CVEs
CVE-2026-39395
GO-2026-5694
BIT-cosign-2026-39395
GHSA-w6c6-c85g-mmv6
Jun 25, 2026
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign References Updated Jun 27, 2026 · Source: OSV.dev
CVE-2026-24122
GO-2026-4529
BIT-cosign-2026-24122
GHSA-wfqv-66vq-46rm
Feb 23, 2026
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign References Updated Jun 16, 2026 · Source: OSV.dev
CVE-2026-22703
GO-2026-4309
BIT-cosign-2026-22703
GHSA-whqx-f9j3-ch6m
Jan 13, 2026
Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign References Updated Aug 24, 2026 · Source: OSV.dev
CVE-2024-29902
GO-2024-2718
BIT-cosign-2024-29902
GHSA-88jx-383q-w4qc
Jun 05, 2024
Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-29903
GO-2024-2719
BIT-cosign-2024-29903
GHSA-95pr-fxf5-86gv
Jun 05, 2024
Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-36056
GO-2022-0998
BIT-cosign-2022-36056
GHSA-8gw7-4j42-w388
Nov 09, 2023
Improper blob verification in github.com/sigstore/cosign Improper blob verification in github.com/sigstore/cosign Fixed in
1.12.0
References Updated May 20, 2024 · Source: OSV.dev
CVE-2023-46737
GO-2023-2181
BIT-cosign-2023-46737
GHSA-vfp6-jrw2-99g9
Nov 09, 2023
Denial of service attack from remote registry in github.com/sigstore/cosign An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack. References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-35929
GO-2022-0758
BIT-cosign-2022-35929
GHSA-vjxv-45g9-9296
Nov 09, 2023
Improper verification of signature attestations in github.com/sigstore/cosign Improper verification of signature attestations in github.com/sigstore/cosign Fixed in
1.10.1
References Updated May 20, 2024 · Source: OSV.dev |
v1.10.0-rc.1
pre
Dependencies (81)
+ 73 more |
|
v1.9.0
minor
8 CVEs
CVE-2026-39395
GO-2026-5694
BIT-cosign-2026-39395
GHSA-w6c6-c85g-mmv6
Jun 25, 2026
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign References Updated Jun 27, 2026 · Source: OSV.dev
CVE-2026-24122
GO-2026-4529
BIT-cosign-2026-24122
GHSA-wfqv-66vq-46rm
Feb 23, 2026
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign References Updated Jun 16, 2026 · Source: OSV.dev
CVE-2026-22703
GO-2026-4309
BIT-cosign-2026-22703
GHSA-whqx-f9j3-ch6m
Jan 13, 2026
Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign References Updated Aug 24, 2026 · Source: OSV.dev
CVE-2024-29902
GO-2024-2718
BIT-cosign-2024-29902
GHSA-88jx-383q-w4qc
Jun 05, 2024
Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-29903
GO-2024-2719
BIT-cosign-2024-29903
GHSA-95pr-fxf5-86gv
Jun 05, 2024
Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-36056
GO-2022-0998
BIT-cosign-2022-36056
GHSA-8gw7-4j42-w388
Nov 09, 2023
Improper blob verification in github.com/sigstore/cosign Improper blob verification in github.com/sigstore/cosign Fixed in
1.12.0
References Updated May 20, 2024 · Source: OSV.dev
CVE-2023-46737
GO-2023-2181
BIT-cosign-2023-46737
GHSA-vfp6-jrw2-99g9
Nov 09, 2023
Denial of service attack from remote registry in github.com/sigstore/cosign An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack. References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-35929
GO-2022-0758
BIT-cosign-2022-35929
GHSA-vjxv-45g9-9296
Nov 09, 2023
Improper verification of signature attestations in github.com/sigstore/cosign Improper verification of signature attestations in github.com/sigstore/cosign Fixed in
1.10.1
References Updated May 20, 2024 · Source: OSV.dev |
v1.9.0
minor
Dependencies (90)
+ 82 more |
|
v1.8.0
minor
8 CVEs
CVE-2026-39395
GO-2026-5694
BIT-cosign-2026-39395
GHSA-w6c6-c85g-mmv6
Jun 25, 2026
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign References Updated Jun 27, 2026 · Source: OSV.dev
CVE-2026-24122
GO-2026-4529
BIT-cosign-2026-24122
GHSA-wfqv-66vq-46rm
Feb 23, 2026
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign References Updated Jun 16, 2026 · Source: OSV.dev
CVE-2026-22703
GO-2026-4309
BIT-cosign-2026-22703
GHSA-whqx-f9j3-ch6m
Jan 13, 2026
Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign References Updated Aug 24, 2026 · Source: OSV.dev
CVE-2024-29902
GO-2024-2718
BIT-cosign-2024-29902
GHSA-88jx-383q-w4qc
Jun 05, 2024
Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-29903
GO-2024-2719
BIT-cosign-2024-29903
GHSA-95pr-fxf5-86gv
Jun 05, 2024
Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-36056
GO-2022-0998
BIT-cosign-2022-36056
GHSA-8gw7-4j42-w388
Nov 09, 2023
Improper blob verification in github.com/sigstore/cosign Improper blob verification in github.com/sigstore/cosign Fixed in
1.12.0
References Updated May 20, 2024 · Source: OSV.dev
CVE-2023-46737
GO-2023-2181
BIT-cosign-2023-46737
GHSA-vfp6-jrw2-99g9
Nov 09, 2023
Denial of service attack from remote registry in github.com/sigstore/cosign An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack. References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-35929
GO-2022-0758
BIT-cosign-2022-35929
GHSA-vjxv-45g9-9296
Nov 09, 2023
Improper verification of signature attestations in github.com/sigstore/cosign Improper verification of signature attestations in github.com/sigstore/cosign Fixed in
1.10.1
References Updated May 20, 2024 · Source: OSV.dev |
v1.8.0
minor
Dependencies (89)
+ 81 more |
|
v1.7.2
patch
8 CVEs
CVE-2026-39395
GO-2026-5694
BIT-cosign-2026-39395
GHSA-w6c6-c85g-mmv6
Jun 25, 2026
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign References Updated Jun 27, 2026 · Source: OSV.dev
CVE-2026-24122
GO-2026-4529
BIT-cosign-2026-24122
GHSA-wfqv-66vq-46rm
Feb 23, 2026
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign References Updated Jun 16, 2026 · Source: OSV.dev
CVE-2026-22703
GO-2026-4309
BIT-cosign-2026-22703
GHSA-whqx-f9j3-ch6m
Jan 13, 2026
Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign References Updated Aug 24, 2026 · Source: OSV.dev
CVE-2024-29902
GO-2024-2718
BIT-cosign-2024-29902
GHSA-88jx-383q-w4qc
Jun 05, 2024
Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-29903
GO-2024-2719
BIT-cosign-2024-29903
GHSA-95pr-fxf5-86gv
Jun 05, 2024
Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-36056
GO-2022-0998
BIT-cosign-2022-36056
GHSA-8gw7-4j42-w388
Nov 09, 2023
Improper blob verification in github.com/sigstore/cosign Improper blob verification in github.com/sigstore/cosign Fixed in
1.12.0
References Updated May 20, 2024 · Source: OSV.dev
CVE-2023-46737
GO-2023-2181
BIT-cosign-2023-46737
GHSA-vfp6-jrw2-99g9
Nov 09, 2023
Denial of service attack from remote registry in github.com/sigstore/cosign An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack. References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-35929
GO-2022-0758
BIT-cosign-2022-35929
GHSA-vjxv-45g9-9296
Nov 09, 2023
Improper verification of signature attestations in github.com/sigstore/cosign Improper verification of signature attestations in github.com/sigstore/cosign Fixed in
1.10.1
References Updated May 20, 2024 · Source: OSV.dev |
v1.7.2
patch
Dependencies (89)
+ 81 more |
|
v1.7.1
patch
8 CVEs
CVE-2026-39395
GO-2026-5694
BIT-cosign-2026-39395
GHSA-w6c6-c85g-mmv6
Jun 25, 2026
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign References Updated Jun 27, 2026 · Source: OSV.dev
CVE-2026-24122
GO-2026-4529
BIT-cosign-2026-24122
GHSA-wfqv-66vq-46rm
Feb 23, 2026
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign References Updated Jun 16, 2026 · Source: OSV.dev
CVE-2026-22703
GO-2026-4309
BIT-cosign-2026-22703
GHSA-whqx-f9j3-ch6m
Jan 13, 2026
Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign References Updated Aug 24, 2026 · Source: OSV.dev
CVE-2024-29902
GO-2024-2718
BIT-cosign-2024-29902
GHSA-88jx-383q-w4qc
Jun 05, 2024
Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-29903
GO-2024-2719
BIT-cosign-2024-29903
GHSA-95pr-fxf5-86gv
Jun 05, 2024
Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-36056
GO-2022-0998
BIT-cosign-2022-36056
GHSA-8gw7-4j42-w388
Nov 09, 2023
Improper blob verification in github.com/sigstore/cosign Improper blob verification in github.com/sigstore/cosign Fixed in
1.12.0
References Updated May 20, 2024 · Source: OSV.dev
CVE-2023-46737
GO-2023-2181
BIT-cosign-2023-46737
GHSA-vfp6-jrw2-99g9
Nov 09, 2023
Denial of service attack from remote registry in github.com/sigstore/cosign An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack. References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-35929
GO-2022-0758
BIT-cosign-2022-35929
GHSA-vjxv-45g9-9296
Nov 09, 2023
Improper verification of signature attestations in github.com/sigstore/cosign Improper verification of signature attestations in github.com/sigstore/cosign Fixed in
1.10.1
References Updated May 20, 2024 · Source: OSV.dev |
v1.7.1
patch
Dependencies (89)
+ 81 more |
|
v1.7.0
minor
8 CVEs
CVE-2026-39395
GO-2026-5694
BIT-cosign-2026-39395
GHSA-w6c6-c85g-mmv6
Jun 25, 2026
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign References Updated Jun 27, 2026 · Source: OSV.dev
CVE-2026-24122
GO-2026-4529
BIT-cosign-2026-24122
GHSA-wfqv-66vq-46rm
Feb 23, 2026
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign References Updated Jun 16, 2026 · Source: OSV.dev
CVE-2026-22703
GO-2026-4309
BIT-cosign-2026-22703
GHSA-whqx-f9j3-ch6m
Jan 13, 2026
Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign References Updated Aug 24, 2026 · Source: OSV.dev
CVE-2024-29902
GO-2024-2718
BIT-cosign-2024-29902
GHSA-88jx-383q-w4qc
Jun 05, 2024
Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-29903
GO-2024-2719
BIT-cosign-2024-29903
GHSA-95pr-fxf5-86gv
Jun 05, 2024
Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-36056
GO-2022-0998
BIT-cosign-2022-36056
GHSA-8gw7-4j42-w388
Nov 09, 2023
Improper blob verification in github.com/sigstore/cosign Improper blob verification in github.com/sigstore/cosign Fixed in
1.12.0
References Updated May 20, 2024 · Source: OSV.dev
CVE-2023-46737
GO-2023-2181
BIT-cosign-2023-46737
GHSA-vfp6-jrw2-99g9
Nov 09, 2023
Denial of service attack from remote registry in github.com/sigstore/cosign An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack. References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-35929
GO-2022-0758
BIT-cosign-2022-35929
GHSA-vjxv-45g9-9296
Nov 09, 2023
Improper verification of signature attestations in github.com/sigstore/cosign Improper verification of signature attestations in github.com/sigstore/cosign Fixed in
1.10.1
References Updated May 20, 2024 · Source: OSV.dev |
v1.7.0
minor
Dependencies (89)
+ 81 more |
|
v1.6.0
initial
8 CVEs
CVE-2026-39395
GO-2026-5694
BIT-cosign-2026-39395
GHSA-w6c6-c85g-mmv6
Jun 25, 2026
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign References Updated Jun 27, 2026 · Source: OSV.dev
CVE-2026-24122
GO-2026-4529
BIT-cosign-2026-24122
GHSA-wfqv-66vq-46rm
Feb 23, 2026
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign References Updated Jun 16, 2026 · Source: OSV.dev
CVE-2026-22703
GO-2026-4309
BIT-cosign-2026-22703
GHSA-whqx-f9j3-ch6m
Jan 13, 2026
Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign References Updated Aug 24, 2026 · Source: OSV.dev
CVE-2024-29902
GO-2024-2718
BIT-cosign-2024-29902
GHSA-88jx-383q-w4qc
Jun 05, 2024
Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-29903
GO-2024-2719
BIT-cosign-2024-29903
GHSA-95pr-fxf5-86gv
Jun 05, 2024
Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-36056
GO-2022-0998
BIT-cosign-2022-36056
GHSA-8gw7-4j42-w388
Nov 09, 2023
Improper blob verification in github.com/sigstore/cosign Improper blob verification in github.com/sigstore/cosign Fixed in
1.12.0
References Updated May 20, 2024 · Source: OSV.dev
CVE-2023-46737
GO-2023-2181
BIT-cosign-2023-46737
GHSA-vfp6-jrw2-99g9
Nov 09, 2023
Denial of service attack from remote registry in github.com/sigstore/cosign An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack. References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-35929
GO-2022-0758
BIT-cosign-2022-35929
GHSA-vjxv-45g9-9296
Nov 09, 2023
Improper verification of signature attestations in github.com/sigstore/cosign Improper verification of signature attestations in github.com/sigstore/cosign Fixed in
1.10.1
References Updated May 20, 2024 · Source: OSV.dev |
v1.6.0
initial
Dependencies (84)
+ 76 more |