Vulnerability GHSA-w6c6-c85g-mmv6: Information

Description

Cosign's verify-blob-attestation reports false positive when payload parsing fails

Severity: MEDIUM (4.3)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

URL: https://github.com/advisories/GHSA-w6c6-c85g-mmv6

Published: April 8, 2026

Modified: April 8, 2026

Error type identifier: CWE-754

Fixed packages

Package name	Branch	Fixed in version	Version from repository	Errata ID	Task #	State
cosign	sisyphus	3.0.6-alt1	3.0.6-alt1	ALT-PU-2026-5932-2	414543	Fixed
cosign	sisyphus_riscv64	3.0.6-alt1	3.0.6-alt1	ALT-PU-2026-6061-1	-	Fixed
cosign	sisyphus_loongarch64	3.0.6-alt1	3.0.6-alt1	ALT-PU-2026-5997-1	-	Fixed
cosign	p11	3.0.6-alt1	3.0.6-alt1	ALT-PU-2026-5940-2	414548	Fixed
cosign	c10f2	3.0.6-alt1	3.0.6-alt1	ALT-PU-2026-5938-2	414547	Fixed

Ecosystem	Name	Affected versions	Patched versions
Go	github.com/sigstore/cosign	>=3.0.0, <3.0.6 <2.6.3	3.0.6 2.6.3

Hyperlink	Resource
https://github.com/sigstore/cosign/security/advisories/GHSA-w6c6-c85g-mmv6	WEB
https://nvd.nist.gov/vuln/detail/CVE-2026-39395	ADVISORY
https://github.com/sigstore/cosign	PACKAGE
CVE-2026-39395	CVE

Version: v26.5.1