Vulnerability Report: GO-2023-2181

• CVE-2023-46737, GHSA-vfp6-jrw2-99g9
• Affects: github.com/sigstore/cosign, github.com/sigstore/cosign/v2
• Published: Nov 09, 2023
• Modified: May 20, 2024

An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack.