dev.sigstore/sigstore-java vulnerabilities

Latest dev.sigstore/sigstore-java CVEs

Newest publication first

1. CVE-2026-48791 Sigstore Java has a vulnerability with bundle verification of integratedTime

   Published 2026-08-12

   Low·CVSS 2.0 EPSS 0.07%

   sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor entry) time) against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the...

2. CVE-2024-53267 sigstore-java has vulnerability with bundle verification

   Medium·CVSS 5.4

   Summary sigstore-java has insufficient verification for a situation where a validly-signed but "mismatched" bundle is presented as proof of inclusion into a transparency log Impact This bug impacts clients using any variation of KeylessVerifier.verify() The verifier may accept a...

3. CVE-2024-54140 sigstore-java has a vulnerability with bundle verification

   Low·CVSS 2.1

   Summary sigstore-java has insufficient verification for a situation where a bundle provides a invalid signature for a checkpoint. Impact This bug impacts clients using any variation of KeylessVerifier.verify() Currently checkpoints are only used to ensure the root hash of an incl...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.