GO-2026-5694
- Source
- https://pkg.go.dev/vuln/GO-2026-5694
- Import Source
- https://vuln.go.dev/ID/GO-2026-5694.json
- JSON Data
- https://api.osv.dev/v1/vulns/GO-2026-5694
- Aliases
-
- BIT-cosign-2026-39395
- CVE-2026-39395
- GHSA-w6c6-c85g-mmv6
- Related
- Published
- 2026-06-25T22:34:38Z
- Modified
- 2026-06-27T02:14:27.010522086Z
- Summary
- Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign
- Details
-
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign
- Database specific
{ "review_status": "UNREVIEWED", "url": "https://pkg.go.dev/vuln/GO-2026-5694" }- References
Affected packages
Go / github.com/sigstore/cosign
Package
- Name
- github.com/sigstore/cosign
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/sigstore/cosign
Go / github.com/sigstore/cosign/v2
Package
- Name
- github.com/sigstore/cosign/v2
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/sigstore/cosign/v2
Go / github.com/sigstore/cosign/v3
Package
- Name
- github.com/sigstore/cosign/v3
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/sigstore/cosign/v3