sigstore vulnerabilities

CVEs per yearBy the year they were published

1. 20224
2. 20234
3. 20247
4. 20252
5. 202623

Newest CVEs

• CVE-2026-118763

  @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location

  sigstore · sigstore-js

  High7.4
• CVE-2026-48702

  Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

  sigstore · rekor

  High7.5
• CVE-2026-49478

  Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

  sigstore · fulcio

  High8.7
• CVE-2026-48791

  Sigstore Java has a vulnerability with bundle verification of integratedTime

  sigstore · sigstore-java

  Low2.0
• CVE-2026-54787

  sigstore-go fails to check signature timestamps against a signing key's validity period

  sigstore · sigstore-go

  Low3.1
• CVE-2026-49834

  sigstore-go: Multi-log threshold bypass via single compromised log

  sigstore · sigstore-go

  Medium5.9
• CVE-2026-49835

  Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality

  sigstore · timestamp-authority

  Medium5.9
• CVE-2026-48816

  sigstore-js: Insufficient Verification of Data Authenticity

  sigstore · sigstore-js

  Medium6.5
• CVE-2026-48758

  sigstore-js: DSSE payloadType type-binding failure

  sigstore · sigstore-js

  Medium5.4
• CVE-2026-48815

  sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced

  sigstore · sigstore-js

  High7.5