github.com/google/go-attestation vulnerabilities
CVEs whose affected-version data names the github.com/google/go-attestation package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-12681Medium· 6.8Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList()
Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList()
▾ Sunlitgoogle · github.com/google/go-attestationEPSS 0.19%via OSV
GHSA-9r4w-jg96-92mvMedium· 6.8Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList()
Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList()
▾ Sunlitgoogle · github.com/google/go-attestationvia GHSA