Vulnerability GO-2026-4529
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
8 months ago
February 23, 2026 at 06:23 PM UTC
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign
v0.1.0 - v1.13.6
v0.1.0 - v1.13.6
Summary
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign
Details
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
4 months ago
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign
* GO-2026-5694
* GO-2026-5694
Unknown
4 months ago
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign
<2.6.3 GO-2026-5694
<2.6.3 GO-2026-5694
Unknown
4 months ago
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign
>=3.0.0 <3.0.6 GO-2026-5694
>=3.0.0 <3.0.6 GO-2026-5694
Medium Risk
7 months ago
Cosign's verify-blob-attestation reports false positive when payload parsing fails
<=1.13.6 GHSA-w6c6-c85g-mmv6
<=1.13.6 GHSA-w6c6-c85g-mmv6
Medium Risk
7 months ago
Cosign's verify-blob-attestation reports false positive when payload parsing fails
<2.6.3 GHSA-w6c6-c85g-mmv6
<2.6.3 GHSA-w6c6-c85g-mmv6
Impacted packages
Timeline
Published
8 months ago
February 23, 2026 at 06:23 PM UTC
Fixed (v3.0.5)
8 months ago
February 19, 2026 at 06:42 PM UTC
Last Modified
5 months ago
June 16, 2026 at 04:44 PM UTC