{"id":"EUVD-2026-30564","revision":"691b25c529d64966a18a46b57a9382ed","records":[{"revision":"691b25c529d64966a18a46b57a9382ed","observedAt":"2026-10-28T06:06:58.128+00:00","statement":{"source":"euvd","id":"EUVD-2026-30564","aliases":["CVE-2026-44310","GHSA-7c37-gx6w-8vc5"],"title":"Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. From 0.4.0 to before 0.15.0, CertVerifier.Verify() in pkg/git/verifier.go unconditionally dereferences certs[0] after sd.GetCertificates() wit…","description":"Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. From 0.4.0 to before 0.15.0, CertVerifier.Verify() in pkg/git/verifier.go unconditionally dereferences certs[0] after sd.GetCertificates() without checking the slice length. A CMS/PKCS7 signed message with an empty certificate set is a structurally valid DER payload; GetCertificates() returns an empty slice with no error, causing an immediate index-out-of-range panic. On the gitsign --verify code path (the GPG-compatible mode invoked by git verify-commit), the panic is silently recovered by internal/io/streams.go's Wrap() function, which returns nil instead of an error. main.go then exits with code 0, causing exit-code-only verification callers to interpret the failed verification as success. This vulnerability is fixed in 0.15.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","score":5.4,"severity":null}],"references":["https://github.com/sigstore/gitsign/security/advisories/GHSA-7c37-gx6w-8vc5"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30564","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 15, 2026, 4:17:53 PM","dateUpdated":"May 15, 2026, 4:44:36 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-30564","identifiers":["EUVD-2026-30564","CVE-2026-44310","GHSA-7c37-gx6w-8vc5"]},"retained":false,"historicalAffected":[]}],"coverage":[]}