{
  "affected": [
    {
      "affectedData": [
        {
          "product": "cosign",
          "vendor": "sigstore",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.0.6"
            },
            {
              "status": "affected",
              "version": "\u003c 2.6.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sigstore:cosign:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E1C20B41-D20F-4FC4-AFD6-00C45B60CC58",
              "versionEndExcluding": "2.6.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sigstore:cosign:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8DD2B507-E86E-4276-86EC-0FDE82CB0BB1",
              "versionEndExcluding": "3.0.6",
              "versionStartIncluding": "3.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign verify-blob-attestation may erroneously report a \"Verified OK\" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely. This vulnerability is fixed in 3.0.6 and 2.6.3."
    },
    {
      "lang": "es",
      "value": "Cosign proporciona firma de c\u00f3digo y transparencia para contenedores y binarios. Antes de 3.0.6 y 2.6.3, cosign verify-blob-attestation podr\u00eda informar err\u00f3neamente un resultado de \u0027Verified OK\u0027 para atestaciones con cargas \u00fatiles malformadas o tipos de predicado no coincidentes. Para paquetes de formato antiguo y firmas separadas, esto se deb\u00eda a un fallo l\u00f3gico en el manejo de errores de la validaci\u00f3n del tipo de predicado. Para paquetes de formato nuevo, la validaci\u00f3n del tipo de predicado fue omitida por completo. Esta vulnerabilidad est\u00e1 corregida en 3.0.6 y 2.6.3."
    }
  ],
  "id": "CVE-2026-39395",
  "lastModified": "2026-07-24T21:10:00.143",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-39395",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-08T15:49:08.895545Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-07T20:16:33.140",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/sigstore/cosign/security/advisories/GHSA-w6c6-c85g-mmv6"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}