GO-2026-5212Published
gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-44310 · Microsoft / collected KEV context
cve-program · CVE-2026-44310
euvd · EUVD-2026-30564
nvd · CVE-2026-44310
osv · GHSA-7c37-gx6w-8vc5
- https://github.com/sigstore/gitsign/security/advisories/GHSA-7c37-gx6w-8vc5
- https://nvd.nist.gov/vuln/detail/CVE-2026-44310
- https://github.com/sigstore/gitsign
osv · GO-2026-5212
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.