sigstore sigstore-java vulnerabilities (CVE)

CVE records published for sigstore sigstore-java, newest first. Follow to get an email when a new one appears.

1 results

2.0Low

CVE-2026-48791 2 months ago

Sigstore Java has a vulnerability with bundle verification of integratedTime

sigstore sigstore-java

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor entry) time) against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancemen…