{"action":"Upgrade github.com/notaryproject/notation to 1.0.0-rc.6 or later.","affected":[{"fixed":"1.0.0-rc.6","introduced":"0"}],"component":"github.com/notaryproject/notation","cve_ids":["CVE-2023-33958"],"ecosystem":"Go","epss":0.00485,"exploited":false,"fixed_versions":["1.0.0-rc.6"],"ghsa_id":"GHSA-rvrx-rrwh-r9p6","id":"tcs_01M5KFN9MZJFHNBVCRDRDFKRWR","modified_at":"2026-09-10T03:50:02.360601255Z","published_at":"2023-06-06T16:44:58Z","references":["https://osv.dev/vulnerability/GHSA-rvrx-rrwh-r9p6","https://github.com/notaryproject/notation/security/advisories/GHSA-rvrx-rrwh-r9p6","https://nvd.nist.gov/vuln/detail/CVE-2023-33958","https://github.com/notaryproject/notation","https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.6"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-rvrx-rrwh-r9p6","url":"https://osv.dev/vulnerability/GHSA-rvrx-rrwh-r9p6"}],"summary":"Notation's default `maxSignatureAttempts` in `notation verify` enables an endless data attack"}