PT-2026-39243 · Gitsign+1 · Gitsign+1

Published

2026-05-08

·

Updated

2026-05-18

·

CVE-2026-44309

CVSS v3.1

5.3

Medium

VectorAV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions Gitsign versions prior to 0.16.0
Description gitsign verify and gitsign verify-tag re-encode commit or tag objects using the EncodeWithoutSignature function from the go-git library before checking the signature, rather than verifying the raw git object bytes. This creates a discrepancy because go-git uses loose parsing; if a malformed object contains duplicate tree headers, go-git discards the first and retains the second, while git-core uses the first.
An attacker can exploit this by crafting a malformed commit with two tree headers. By replaying a valid signature from a legitimate commit over the second tree (which go-git sees), the attacker can make gitsign verify report a valid signature for a commit that git-core resolves to entirely different, attacker-controlled content. This breaks the invariant that the verified signature, the commit semantics presented to users, and the object hash logged in Rekor all refer to the same content.
Recommendations Update Gitsign to version 0.16.0. As a temporary workaround, restrict the use of gitsign verify and gitsign verify-tag on commits from untrusted sources until the update is applied.

Exploit

Fix

Improper Verification of Cryptographic Signature

Improper Certificate Validation

Weakness Enumeration

Related Identifiers

CVE-2026-44309
GHSA-7RMH-48MX-2VWC

Affected Products

Gitsign
Go-Git