sigstore-java vulnerabilities

Latest sigstore-java CVEs

Newest publication first

1. CVE-2026-48791 Sigstore Java has a vulnerability with bundle verification of integratedTime

   Published 2026-08-12

   Low·CVSS 2.0 EPSS 0.07%

   sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor entry) time) against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the...

2. CVE-2024-54140 sigstore-java has a vulnerability with bundle verification

   Published 2024-12-05

   Low·CVSS 2.1 EPSS 0.21%

   sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a bundle provides a invalid signature for a checkpoint. This bug impacts clients using any variation of KeylessVerifier.verify()...

3. CVE-2024-53267 Vulnerability with bundle verification in sigstore-java

   Published 2024-11-26

   Medium·CVSS 5.5 EPSS 0.10%

   sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a validly-signed but "mismatched" bundle is presented as proof of inclusion into a transparency log. This bug impacts clients us...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.