{"id":"EUVD-2026-30563","revision":"09ec914b37b14bb3977fcd86cf28fbbe","records":[{"revision":"09ec914b37b14bb3977fcd86cf28fbbe","observedAt":"2026-10-28T06:06:57.001+00:00","statement":{"source":"euvd","id":"EUVD-2026-30563","aliases":["CVE-2026-44309","GHSA-7rmh-48mx-2vwc"],"title":"Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. Prior to 0.16.0, gitsign verify and gitsign verify-tag re-encode commit/tag objects through go-git's EncodeWithoutSignature before checking th…","description":"Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. Prior to 0.16.0, gitsign verify and gitsign verify-tag re-encode commit/tag objects through go-git's EncodeWithoutSignature before checking the signature, instead of verifying against the raw git object bytes. For malformed objects with duplicate tree headers, git-core and go-git parse different trees: git-core uses the first, go-git uses the second. A signature crafted over the go-git-normalized form (second tree) passes gitsign verify while git-core resolves the commit to a completely different tree. This breaks the invariant that a verified signature, the commit semantics git-core presents to users, and the object hash logged in Rekor all refer to the same content. This vulnerability is fixed in 0.16.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","score":5.3,"severity":null}],"references":["https://github.com/sigstore/gitsign/security/advisories/GHSA-7rmh-48mx-2vwc"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30563","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 15, 2026, 4:22:51 PM","dateUpdated":"May 15, 2026, 5:43:59 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-30563","identifiers":["EUVD-2026-30563","CVE-2026-44309","GHSA-7rmh-48mx-2vwc"]},"retained":false,"historicalAffected":[]}],"coverage":[]}