{"id":"CVE-2023-33957","aliases":["GHSA-9m3v-v4r5-ppx7","GO-2023-1829"],"url":"https://o3.security/vulnerability/CVE-2023-33957","summary":"Denial of service from high number of artifact signatures in notation","details":"notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation inspect command on the same machine. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation packages to v1.0.0-rc.6 or above. Users are advised to upgrade. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries.","published":"2023-06-06T18:10:30.416Z","modified":"2026-08-12T03:51:18.341118084Z","cvss":{"score":2.6,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:N/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/notaryproject/notation","fixedVersion":"1.0.0-rc.6"}],"fix":{"url":"https://github.com/notaryproject/notation/commit/ed22fde52f6d70ae0b53521bd28c9ccafa868c24","label":"notaryproject/notation@ed22fde"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33957.json"},{"type":"ADVISORY","url":"https://github.com/notaryproject/notation/security/advisories/GHSA-9m3v-v4r5-ppx7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33957"},{"type":"FIX","url":"https://github.com/notaryproject/notation/commit/ed22fde52f6d70ae0b53521bd28c9ccafa868c24"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:18.341118084Z"}}