What’s Vulnerable › Products

sigstore cosign vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Check whether your sigstore cosign version is affected

Latest sigstore cosign vulnerabilities

• CVE-2026-39395 — Cosign's verify-blob-attestation reports false positive when payload parsing fails (CVSS 5.3)
• CVE-2026-24122 — Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked (CVSS 3.7)
• CVE-2026-22703 — Cosign verification accepts any valid Rekor entry under certain conditions (CVSS 5.5)
• CVE-2024-29903 — Cosign vulnerable to machine-wide denial of service via malicious artifacts (CVSS 7.5)
• CVE-2024-29902 — Cosign vulnerable to system-wide denial of service via malicious attachments (CVSS 5.9)
• CVE-2023-46737 — Possible endless data attack from attacker-controlled registry in cosign (CVSS 5.3)
• CVE-2022-36056 — Vulnerabilities with blob verification in sigstore cosign (CVSS 5.5)
• CVE-2022-35929 — False positive signature verification in cosign (CVSS 9.8)
• CVE-2022-23649 — Improper Certificate Validation in Cosign (CVSS 3.3)