CVE-2026-39984Published

Sigstore Timestamp Authority has Improper Certificate Validation in verifier

cve-program · CVE-2026-39984

Published

timestamp-authority

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "sigstore",
                    "product": "timestamp-authority",
                    "versions": [
                        {
                            "version": "< 2.0.6",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-22813

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Apr 14, 2026, 11:41:47 PM

dateUpdated: Apr 16, 2026, 2:00:55 PM

11 related source bulletins · separate from aliases

SUSE-SU-2026:22456-1: Security update for docker

CVE-2026-33814 · CVE-2026-39821 · CVE-2026-39984 · CVE-2026-41567

openSUSE-SU-2026:10651-1: trivy-0.70.0-1.1 on GA media

CVE-2025-69725 · CVE-2026-25934 · CVE-2026-33186 · CVE-2026-33747 · CVE-2026-33748 · CVE-2026-34986 · CVE-2026-39984

openSUSE-SU-2026:10702-1: hauler-1.4.3-1.1 on GA media

CVE-2026-34986 · CVE-2026-39984

openSUSE-SU-2026:20711-1: Security update for hauler

CVE-2026-34986 · CVE-2026-39984

openSUSE-SU-2026:21060-1: Security update for docker

CVE-2026-33814 · CVE-2026-39821 · CVE-2026-39984 · CVE-2026-41567

openSUSE-SU-2026:11144-1: docker-29.4.0_ce-40.1 on GA media

CVE-2026-33814 · CVE-2026-39821 · CVE-2026-39984 · CVE-2026-41567

WID-SEC-W-2026-3046: IBM Concert: Mehrere Schwachstellen

CVE-2019-19921 · CVE-2021-23337 · CVE-2024-3651 · CVE-2024-39338 · CVE-2024-45590 · CVE-2025-13465 · CVE-2025-15284 · CVE-2025-15599 · CVE-2025-22874 · CVE-2025-47273 · CVE-2025-47907 · CVE-2025-52881 · CVE-2025-53643 · CVE-2025-55184 · CVE-2025-58056 · CVE-2025-58188 · CVE-2025-58189 · CVE-2025-61723 · CVE-2025-61730 · CVE-2025-64649 · CVE-2025-64756 · CVE-2025-67221 · CVE-2025-68121 · CVE-2025-68146 · CVE-2026-0540 · CVE-2026-2327 · CVE-2026-23490 · CVE-2026-23897 · CVE-2026-2391 · CVE-2026-23949 · CVE-2026-24486 · CVE-2026-25528 · CVE-2026-25547 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-26007 · CVE-2026-26019 · CVE-2026-26996 · CVE-2026-27142 · CVE-2026-27212 · CVE-2026-27699 · CVE-2026-27903 · CVE-2026-27904 · CVE-2026-28684 · CVE-2026-29063 · CVE-2026-29181 · CVE-2026-2950 · CVE-2026-31808 · CVE-2026-31900 · CVE-2026-32274 · CVE-2026-32288 · CVE-2026-32597 · CVE-2026-32630 · CVE-2026-32887 · CVE-2026-32952 · CVE-2026-33186 · CVE-2026-33532 · CVE-2026-33750 · CVE-2026-33814 · CVE-2026-33816 · CVE-2026-33916 · CVE-2026-34043 · CVE-2026-34073 · CVE-2026-34077 · CVE-2026-3520 · CVE-2026-35469 · CVE-2026-35515 · CVE-2026-3627 · CVE-2026-39823 · CVE-2026-39825 · CVE-2026-39826 · CVE-2026-39892 · CVE-2026-39984 · CVE-2026-40175 · CVE-2026-40179 · CVE-2026-40181 · CVE-2026-40190 · CVE-2026-40347 · CVE-2026-41066 · CVE-2026-41182 · CVE-2026-41238 · CVE-2026-41239 · CVE-2026-41240 · CVE-2026-41305 · CVE-2026-41324 · CVE-2026-41425 · CVE-2026-41481 · CVE-2026-41488 · CVE-2026-41602 · CVE-2026-41636 · CVE-2026-42151 · CVE-2026-42154 · CVE-2026-42198 · CVE-2026-42211 · CVE-2026-42338 · CVE-2026-42342 · CVE-2026-42561 · CVE-2026-42577 · CVE-2026-43870 · CVE-2026-44405 · CVE-2026-44431 · CVE-2026-44432 · CVE-2026-44486 · CVE-2026-44487 · CVE-2026-44488 · CVE-2026-44492 · CVE-2026-44494 · CVE-2026-44496 · CVE-2026-44728 · CVE-2026-4539 · CVE-2026-45409 · CVE-2026-45736 · CVE-2026-46625 · CVE-2026-4800 · CVE-2026-4923 · CVE-2026-4926 · CVE-2026-7246 · CVE-2026-8723

SUSE-SU-2026:22285-1: Security update for docker

CVE-2026-33814 · CVE-2026-39821 · CVE-2026-39984 · CVE-2026-41567

SUSE-SU-2026:22367-1: Security update for docker

CVE-2026-33814 · CVE-2026-39821 · CVE-2026-39984 · CVE-2026-41567

openSUSE-SU-2026:20809-1: Security update for trivy

CVE-2025-64702 · CVE-2025-69725 · CVE-2026-25934 · CVE-2026-33186 · CVE-2026-33747 · CVE-2026-33748 · CVE-2026-34986 · CVE-2026-39984 · CVE-2026-41506

SUSE-SU-2026:22513-1: Security update for docker

CVE-2026-33814 · CVE-2026-39821 · CVE-2026-39984 · CVE-2026-41567

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-39984

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Analyzed

Weakness classifications: CWE-295

Original publisher date fields

published: 2026-04-15T04:17:40.203

lastModified: 2026-10-26T21:10:00.170

1 source CPE criteria · context only

cpe:2.3:a:linuxfoundation:sigstore_timestamp_authority:*:*:*:*:*:*:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-xm5m-wgh2-rrg3

Published

github.com/sigstore/timestamp-authority/v2

SEMVER · introduced 0 → fixed 2.0.6

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GO-2026-5763

Published

github.com/sigstore/timestamp-authority

SEMVER · introduced 0

github.com/sigstore/timestamp-authority/v2

SEMVER · introduced 0 → fixed 2.0.6

Original source record · Cite this exact observation · Complete original publisher JSON