PT-2026-39243 · Gitsign+1 · Gitsign+1
Published
2026-05-08
·
Updated
2026-05-18
·
CVE-2026-44309
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Gitsign versions prior to 0.16.0
Description
gitsign verify and gitsign verify-tag re-encode commit or tag objects using the EncodeWithoutSignature function from the go-git library before checking the signature, rather than verifying the raw git object bytes. This creates a discrepancy because go-git uses loose parsing; if a malformed object contains duplicate tree headers, go-git discards the first and retains the second, while git-core uses the first.An attacker can exploit this by crafting a malformed commit with two
tree headers. By replaying a valid signature from a legitimate commit over the second tree (which go-git sees), the attacker can make gitsign verify report a valid signature for a commit that git-core resolves to entirely different, attacker-controlled content. This breaks the invariant that the verified signature, the commit semantics presented to users, and the object hash logged in Rekor all refer to the same content.Recommendations
Update Gitsign to version 0.16.0.
As a temporary workaround, restrict the use of
gitsign verify and gitsign verify-tag on commits from untrusted sources until the update is applied.Exploit
Fix
Improper Verification of Cryptographic Signature
Improper Certificate Validation
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Gitsign
Go-Git