CVE-2022-0317

The CVE-2022-0317 issue affects go-attestation prior to 0.4.0. A local attacker can craft a malicious Quote with no/some PCRs that makes AKPublic.Verify succeed, then reuse the same PCR set in Eventlog.Verify to spoof TCG log events and defeat remotely-attested measured-boot. Public advisories (G...

CVE-2026-19201

Google go-attestation versions up to and including 0.6.1 contain an uncontrolled recursion vulnerability in its Windows SIPA event log parser . The (*WinEvents).readELAMAggregation function recurses for every nested elamAggregation sub-event without enforcing a maximum depth limit, while the size...