CVE-2026-48791

Maven/dev.sigstore:sigstore-java CVE-2026-48791: low 2

Sigstore Java has a vulnerability with bundle verification of integratedTime

Action: Upgrade dev.sigstore:sigstore-java to 2.1.0 or later.

Affected

Fixed versions

Sources

• osv: GHSA-qqw8-7c2r-jxch
• https://github.com/sigstore/sigstore-java/security/advisories/GHSA-qqw8-7c2r-jxch
• https://github.com/sigstore/sigstore-java/pull/1008
• https://github.com/sigstore/sigstore-java/pull/1185
• https://github.com/sigstore/sigstore-java/commit/4b7a49ebb1813f5b1ff113bcad63246358222d61
• https://github.com/sigstore/sigstore-java/commit/b529335728fc5cfb574161b4b3c06859a8a2aa88
• https://github.com/sigstore/sigstore-java

CVE-2026-48791 · published 2026-06-30T18:10:28Z · modified 2026-06-30T18:26:42.215539Z · JSON