maven package report

Is github.com/sigstore/cosign safe?

2 known vulnerabilities.

cvss

not scored

how bad it is if exploited, out of 10

epss

not scored

chance of exploitation in the next 30 days

xyz score

not scored

CyberXYZ composite, out of 10

fig. 01 — BIT-cosign-2024-29903, the advisory selected below

// advisories

BIT-cosign-2024-29903

UNKNOWN

Maliciously-crafted software artifacts can cause denial of service of the machine running Cosign, thereby impacting all services on the machine. The root cause is that Cosign creates slices based on the number of signatures, manifests or attestations in untrusted artifacts. As such, the untrusted artifact can control the amount of memory that Cosign allocates.

Affected: >=0, >=0, <2.2.4
Fixed in: not stated
Weakness: CWE-770
Published: 2024-04-11
Source: osv

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so maven packages are not covered.

Checked 2026-09-22 at 01:42 UTC. The most recent advisory here was published 2024-04-11. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is github.com/sigstore/cosign safe? maven package security report | CyberXYZ