MEDIUM5.4Go
GHSA-7c37-gx6w-8vc5· CVE-2026-44310, GO-2026-5212gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers
Modified: 9/10/2026
package
Go/github.com/sigstore/gitsign
pkg:go/github.com/sigstore/gitsign
MEDIUM5.3Go
GHSA-7rmh-48mx-2vwc· CVE-2026-44309, GO-2026-5233gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits
Modified: 9/10/2026
LOWGo
GHSA-8pmp-678w-c8xx· CVE-2024-51746, GO-2024-3252gitsign may use incorrect Rekor entries during verification
Modified: 11/6/2024
MEDIUM4.2Go
GHSA-xvrc-2wvh-49vc· CVE-2023-47122, GO-2023-2332Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.
Modified: 8/21/2024
—Go
GO-2023-2332· CVE-2023-47122, GHSA-xvrc-2wvh-49vcGitsign's Rekor public keys fetched from upstream API instead of local TUF client. in github.com/sigstore/gitsign
Modified: 3/3/2026
—Go
GO-2024-3252· CVE-2024-51746, GHSA-8pmp-678w-c8xxgitsign may use incorrect Rekor entries during verification in github.com/sigstore/gitsign
Modified: 3/3/2026
—Go
GO-2026-5212· CVE-2026-44310, GHSA-7c37-gx6w-8vc5gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers in github.com/sigstore/gitsign
Modified: 6/25/2026
—Go
GO-2026-5233· CVE-2026-44309, GHSA-7rmh-48mx-2vwcgitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits in github.com/sigstore/gitsign
Modified: 6/25/2026