MEDIUM4.0Go
GHSA-45v3-38pc-874v· CVE-2024-56138, GO-2025-3381notation-go's timestamp signature generation lacks certificate revocation check
Modified: 9/10/2026
package
Go/github.com/notaryproject/notation-go
pkg:go/github.com/notaryproject/notation-go
HIGH7.5Go
GHSA-87x9-7grx-m28v· CVE-2023-25656, GO-2023-1589notation-go has excessive memory allocation on verification
Modified: 9/10/2026
LOW3.3Go
GHSA-qjh3-4j3h-vmwp· CVE-2024-51491, GO-2025-3382notation-go has an OS error when setting CRL cache leads to denial of signature verification
Modified: 9/10/2026
HIGH8.8Go
GHSA-xhg5-42rf-296r· CVE-2023-33959, GO-2023-1832notation-go's verification bypass can cause users to verify the wrong artifact
Modified: 9/10/2026
—Go
GO-2023-1589· CVE-2023-25656, GHSA-87x9-7grx-m28vDenial of service from memory exhaustion in github.com/notaryproject/notation-go
Modified: 2/4/2026
—Go
GO-2023-1832· CVE-2023-33959, GHSA-xhg5-42rf-296rVerification bypass in github.com/notaryproject/notation-go
Modified: 2/4/2026
—Go
GO-2025-3381· CVE-2024-56138, GHSA-45v3-38pc-874vnotation-go's timestamp signature generation lacks certificate revocation check in github.com/notaryproject/notation-go
Modified: 2/4/2026
—Go
GO-2025-3382· CVE-2024-51491, GHSA-qjh3-4j3h-vmwpnotation-go has an OS error when setting CRL cache leads to denial of signature verification in github.com/notaryproject/notation-go
Modified: 2/4/2026