Vulnerability GO-2026-5694
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
4 months ago
June 25, 2026 at 10:34 PM UTC
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign
v0.1.0 - v1.13.6
v0.1.0 - v1.13.6
Summary
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign
Details
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
7 months ago
Cosign's verify-blob-attestation reports false positive when payload parsing fails
<=1.13.6 GHSA-w6c6-c85g-mmv6
<=1.13.6 GHSA-w6c6-c85g-mmv6
Medium Risk
7 months ago
Cosign's verify-blob-attestation reports false positive when payload parsing fails
<2.6.3 GHSA-w6c6-c85g-mmv6
<2.6.3 GHSA-w6c6-c85g-mmv6
Medium Risk
7 months ago
Cosign's verify-blob-attestation reports false positive when payload parsing fails
>=3.0.0 <3.0.6 GHSA-w6c6-c85g-mmv6
>=3.0.0 <3.0.6 GHSA-w6c6-c85g-mmv6
Unknown
8 months ago
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign
* GO-2026-4529
* GO-2026-4529
Unknown
8 months ago
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign
* GO-2026-4529
* GO-2026-4529
Impacted packages
Timeline
Published
4 months ago
June 25, 2026 at 10:34 PM UTC
Fixed (v2.6.3)
7 months ago
April 06, 2026 at 09:25 PM UTC
Fixed (v3.0.6)
7 months ago
April 06, 2026 at 09:39 PM UTC
Last Modified
4 months ago
June 27, 2026 at 02:14 AM UTC