Go/github.com/sigstore/timestamp-authority/v2 CVE-2026-39984: medium 5.5, EPSS 0.10%

Sigstore Timestamp Authority has Improper Certificate Validation in verifier in github.com/sigstore/timestamp-authority

Action: Upgrade github.com/sigstore/timestamp-authority/v2 to 2.0.6 or later.

go get github.com/sigstore/timestamp-authority/v2@v2.0.6

Affected

Fixed versions

Sources

• osv: GO-2026-5763#Go/github.com/sigstore/timestamp-authority/v2
• nvd: CVE-2026-39984
• https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-xm5m-wgh2-rrg3
• https://github.com/sigstore/timestamp-authority/releases/tag/v2.0.6

CVE-2026-39984 · published 2026-06-25T22:34:41Z · modified 2026-06-26T15:44:23.064396068Z · JSON