sigstore cosign
9 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-39395 | >= 3.0.0, < 3.0.6 ; < 2.6.3 | Cosign's verify-blob-attestation reports false positive when payload parsing fails | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-24122 | < 3.0.5 | Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked | LOW 3.7 | 0.2 % | ||
| CVE-2026-22703 | < 3.0.4 ; < 2.6.2 | Cosign verification accepts any valid Rekor entry under certain conditions | MEDIUM 5.5 | 0.1 % | ||
| CVE-2024-29903 | < 2.2.4 | Cosign vulnerable to machine-wide denial of service via malicious artifacts | HIGH 7.5 | 0.9 % | ||
| CVE-2024-29902 | < 2.2.4 | Cosign vulnerable to system-wide denial of service via malicious attachments | MEDIUM 5.9 | 0.7 % | ||
| CVE-2023-46737 | < 2.2.1 | Possible endless data attack from attacker-controlled registry in cosign | MEDIUM 5.3 | 0.6 % | ||
| CVE-2022-36056 | < 1.12.0 | Vulnerabilities with blob verification in sigstore cosign | MEDIUM 5.5 | 0.1 % | ||
| CVE-2022-35929 | < 1.10.1 | False positive signature verification in cosign | CRITICAL 9.8 | 0.7 % | ||
| CVE-2022-23649 | < 1.5.2 | Improper Certificate Validation in Cosign | LOW 3.3 | 0.2 % |