Improper Check for Unusual or Exceptional Conditions Affecting zot package, versions <2.1.18-r1


Severity

Recommended
0.0
medium
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.24% (15th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-WOLFILATEST-ZOT-17673385
  • published29 Jun 2026
  • disclosed7 Apr 2026

Introduced: 7 Apr 2026

CVE-2026-39395  (opens in a new tab)
CWE-754  (opens in a new tab)

How to fix?

Upgrade Wolfi zot to version 2.1.18-r1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream zot package and not the zot package as distributed by Wolfi. See How to fix? for Wolfi relevant fixed versions and status.

Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign verify-blob-attestation may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely. This vulnerability is fixed in 3.0.6 and 2.6.3.

CVSS Base Scores

version 3.1