CVE-2026-44310

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44310", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T19:00:06.021Z", "datePublished": "2026-05-15T16:17:53.558Z", "dateUpdated": "2026-05-15T16:44:36.684Z"}, "containers": {"cna": {"title": "gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers", "problemTypes": [{"descriptions": [{"cweId": "CWE-129", "lang": "en", "description": "CWE-129: Improper Validation of Array Index", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-390", "lang": "en", "description": "CWE-390: Detection of Error Condition Without Action", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/sigstore/gitsign/security/advisories/GHSA-7c37-gx6w-8vc5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sigstore/gitsign/security/advisories/GHSA-7c37-gx6w-8vc5"}], "affected": [{"vendor": "sigstore", "product": "gitsign", "versions": [{"version": ">= 0.4.0, < 0.15.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-15T16:17:53.558Z"}, "descriptions": [{"lang": "en", "value": "Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. From 0.4.0 to before 0.15.0, CertVerifier.Verify() in pkg/git/verifier.go unconditionally dereferences certs[0] after sd.GetCertificates() without checking the slice length. A CMS/PKCS7 signed message with an empty certificate set is a structurally valid DER payload; GetCertificates() returns an empty slice with no error, causing an immediate index-out-of-range panic. On the gitsign --verify code path (the GPG-compatible mode invoked by git verify-commit), the panic is silently recovered by internal/io/streams.go's Wrap() function, which returns nil instead of an error. main.go then exits with code 0, causing exit-code-only verification callers to interpret the failed verification as success. This vulnerability is fixed in 0.15.0."}], "source": {"advisory": "GHSA-7c37-gx6w-8vc5", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/sigstore/gitsign/security/advisories/GHSA-7c37-gx6w-8vc5", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-15T16:44:32.980771Z", "id": "CVE-2026-44310", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-15T16:44:36.684Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44310", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T19:00:06.021Z", "datePublished": "2026-05-15T16:17:53.558Z", "dateUpdated": "2026-05-15T16:44:36.684Z"}, "containers": {"cna": {"title": "gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers", "problemTypes": [{"descriptions": [{"cweId": "CWE-129", "lang": "en", "description": "CWE-129: Improper Validation of Array Index", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-390", "lang": "en", "description": "CWE-390: Detection of Error Condition Without Action", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/sigstore/gitsign/security/advisories/GHSA-7c37-gx6w-8vc5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sigstore/gitsign/security/advisories/GHSA-7c37-gx6w-8vc5"}], "affected": [{"vendor": "sigstore", "product": "gitsign", "versions": [{"version": ">= 0.4.0, < 0.15.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-15T16:17:53.558Z"}, "descriptions": [{"lang": "en", "value": "Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. From 0.4.0 to before 0.15.0, CertVerifier.Verify() in pkg/git/verifier.go unconditionally dereferences certs[0] after sd.GetCertificates() without checking the slice length. A CMS/PKCS7 signed message with an empty certificate set is a structurally valid DER payload; GetCertificates() returns an empty slice with no error, causing an immediate index-out-of-range panic. On the gitsign --verify code path (the GPG-compatible mode invoked by git verify-commit), the panic is silently recovered by internal/io/streams.go's Wrap() function, which returns nil instead of an error. main.go then exits with code 0, causing exit-code-only verification callers to interpret the failed verification as success. This vulnerability is fixed in 0.15.0."}], "source": {"advisory": "GHSA-7c37-gx6w-8vc5", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44310", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-15T16:44:32.980771Z"}}}], "references": [{"url": "https://github.com/sigstore/gitsign/security/advisories/GHSA-7c37-gx6w-8vc5", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-15T16:44:27.724Z"}}]}}

{"affected": [{"affectedData": [{"product": "gitsign", "vendor": "sigstore", "versions": [{"status": "affected", "version": ">= 0.4.0, < 0.15.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. From 0.4.0 to before 0.15.0, CertVerifier.Verify() in pkg/git/verifier.go unconditionally dereferences certs[0] after sd.GetCertificates() without checking the slice length. A CMS/PKCS7 signed message with an empty certificate set is a structurally valid DER payload; GetCertificates() returns an empty slice with no error, causing an immediate index-out-of-range panic. On the gitsign --verify code path (the GPG-compatible mode invoked by git verify-commit), the panic is silently recovered by internal/io/streams.go's Wrap() function, which returns nil instead of an error. main.go then exits with code 0, causing exit-code-only verification callers to interpret the failed verification as success. This vulnerability is fixed in 0.15.0."}, {"lang": "es", "value": "Gitsign es una herramienta de firma Sigstore sin clave para commits de Git con tu identidad de GitHub / OIDC. Desde la versi\u00f3n 0.4.0 hasta antes de la 0.15.0, CertVerifier.Verify() en pkg/git/verifier.go desreferencia incondicionalmente certs[0] despu\u00e9s de sd.GetCertificates() sin verificar la longitud del slice. Un mensaje firmado CMS/PKCS7 con un conjunto de certificados vac\u00edo es una carga \u00fatil DER estructuralmente v\u00e1lida; GetCertificates() devuelve un slice vac\u00edo sin error, causando un p\u00e1nico inmediato por \u00edndice fuera de rango. En la ruta de c\u00f3digo gitsign --verify (el modo compatible con GPG invocado por git verify-commit), el p\u00e1nico es recuperado silenciosamente por la funci\u00f3n Wrap() de internal/io/streams.go, que devuelve nil en lugar de un error. main.go luego sale con el c\u00f3digo 0, haciendo que los llamadores de verificaci\u00f3n que solo dependen del c\u00f3digo de salida interpreten la verificaci\u00f3n fallida como un \u00e9xito. Esta vulnerabilidad se corrige en la versi\u00f3n 0.15.0."}], "id": "CVE-2026-44310", "lastModified": "2026-10-26T14:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44310", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-15T16:44:32.980771Z", "version": "2.0.3"}}]}, "published": "2026-05-15T17:16:47.430", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/sigstore/gitsign/security/advisories/GHSA-7c37-gx6w-8vc5"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/sigstore/gitsign/security/advisories/GHSA-7c37-gx6w-8vc5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-129"}, {"lang": "en", "value": "CWE-390"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.4.0,0.15.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "gitsign", "source": "cna", "vendor": "sigstore"}, "product": "gitsign", "vendor": "sigstore"}], "created": "2026-05-15T17:30:04.314337+00:00", "updated": "2026-05-15T17:30:04.549159+00:00", "vendors": ["sigstore", "sigstore$PRODUCT$gitsign"]}