DEBIAN-CVE-2026-54787

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

CVE-2024-45395

Sigstore-go versions before 0.6.1 are vulnerable to an Endless data attack when verifying Sigstore Bundles containing large amounts of verifiable data (signed transparency log entries, RFC 3161 timestamps, attestation subjects). The issue causes high CPU usage and can disrupt verification process...

PT-2024-31599

Name of the Vulnerable Software and Affected Versions: sigstore-go versions prior to 0.6.1 Description: The issue is related to a denial of service attack that can occur when a verifier is provided a maliciously crafted Sigstore Bundle containing large amounts of verifiable data. This data can be...

CVE-2024-45395: Loop with Unreachable Exit Condition

sigstore-go, a Go library for Sigstore signing and verification, is susceptible to a denial of service attack in versions prior to 0.6.1 when a verifier is provided a maliciously crafted Sigstore Bundle containing large amounts of verifiable data, in the form of signed transparency log entries, R...