{"action":"Upgrade dev.sigstore:sigstore-java to 2.1.0 or later.","affected":[{"fixed":"2.1.0","introduced":"2.0.0"}],"component":"dev.sigstore:sigstore-java","cve_ids":["CVE-2026-48791"],"ecosystem":"Maven","epss":0.00071,"exploited":false,"fixed_versions":["2.1.0"],"ghsa_id":"GHSA-qqw8-7c2r-jxch","id":"tcs_01M5N9A5N07C7MHG1DHZAP8MWY","modified_at":"2026-06-30T18:26:42.215539Z","published_at":"2026-06-30T18:10:28Z","references":["https://osv.dev/vulnerability/GHSA-qqw8-7c2r-jxch","https://github.com/sigstore/sigstore-java/security/advisories/GHSA-qqw8-7c2r-jxch","https://github.com/sigstore/sigstore-java/pull/1008","https://github.com/sigstore/sigstore-java/pull/1185","https://github.com/sigstore/sigstore-java/commit/4b7a49ebb1813f5b1ff113bcad63246358222d61","https://github.com/sigstore/sigstore-java/commit/b529335728fc5cfb574161b4b3c06859a8a2aa88","https://github.com/sigstore/sigstore-java"],"severity":{"label":"low","score":2},"sources":[{"source":"osv","source_id":"GHSA-qqw8-7c2r-jxch","url":"https://osv.dev/vulnerability/GHSA-qqw8-7c2r-jxch"}],"summary":"Sigstore Java has a vulnerability with bundle verification of integratedTime"}