Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. From 0.4.0 to before 0.15.0, CertVerifier.Verify() in pkg/git/verifier.go unconditionally dereferences certs[0] after sd.GetCertificates() without checking the slice length. A CMS/PKCS7 signed message with an empty certificate set is a structurally valid DER payload; GetCertificates() returns an empty slice with no error, causing an immediate index-out-of-range panic. On the gitsign --verify code path (the GPG-compatible mode invoked by git verify-commit), the panic is silently recovered by internal/io/streams.go's Wrap() function, which returns nil instead of an error. main.go then exits with code 0, causing exit-code-only verification callers to interpret the failed verification as success. This vulnerability is fixed in 0.15.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. From     0.4.0 to before 0.15.0, CertVerifier.Verify() in pkg/git/verifier.go unconditionally dereferences certs[0]     after sd.GetCertificates() without checking the slice length. A CMS/PKCS7 signed message with an empty     certificate set is a structurally valid DER payload; GetCertificates() returns an empty slice with no     error, causing an immediate index-out-of-range panic. On the gitsign --verify code path (the GPG-     compatible mode invoked by git verify-commit), the panic is silently recovered by internal/io/streams.go's     Wrap() function, which returns nil instead of an error. main.go then exits with code 0, causing exit-code-     only verification callers to interpret the failed verification as success. This vulnerability is fixed in     0.15.0. (CVE-2026-44310)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. From
    0.4.0 to before 0.15.0, CertVerifier.Verify() in pkg/git/verifier.go unconditionally dereferences certs[0]
    after sd.GetCertificates() without checking the slice length. A CMS/PKCS7 signed message with an empty
    certificate set is a structurally valid DER payload; GetCertificates() returns an empty slice with no
    error, causing an immediate index-out-of-range panic. On the gitsign --verify code path (the GPG-
    compatible mode invoked by git verify-commit), the panic is silently recovered by internal/io/streams.go's
    Wrap() function, which returns nil instead of an error. main.go then exits with code 0, causing exit-code-
    only verification callers to interpret the failed verification as success. This vulnerability is fixed in
    0.15.0. (CVE-2026-44310)

ID	Name	Product	Family	Severity
315011	Linux Distros Unpatched Vulnerability : CVE-2026-44310	Nessus	Misc.	medium
441524	SCA: security update for github.com/sigstore/gitsign (GHSA-7c37-gx6w-8vc5)	Tenable Cloud Security	SCA Checks	medium
441524	SCA: security update for github.com/sigstore/gitsign (GHSA-7c37-gx6w-8vc5)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-44310

medium

Tenable Plugins

medium

medium

medium