CVE-2023-25656
notation-go has excessive memory allocation on verification
Reported by github_m · Published February 20, 2023
github.com/notaryproject/notation-go is fixed in v1.0.0-rc.3 and 1.0.0-rc.3 (Go Modules)
notation-go is a collection of libraries for supporting Notation sign, verify, push, and pull of oci artifacts. Prior to version 1.0.0-rc.3, notation-go users will find their application using excessive memory when verifying signatures. The application will be killed, and thus availability is impacted. The problem has been patched in the release v1.0.0-rc.3. Some workarounds are available. Users can review their own trust policy file and check if the identity string contains `=#`. Meanwhile, users should only put trusted certificates in their trust stores referenced by their own trust policy files, and make sure the `authenticity` validation is set to `enforce`.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| github.com/notaryproject/notation-go | Go Modules | v1.0.0-rc.3, 1.0.0-rc.3 |
| zot | Chainguard | 2.1.2-r7 |
| kyverno | Chainguard | 1.11.0-r1 |
| zot | Wolfi | 2.1.2-r7 |
| kyverno | Wolfi | 1.11.0-r1 |
| notation-go | notaryproject | 1.0.0-rc.3 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| notaryproject | notation-go | 1.0.0-rc.3 |
| github.com | notaryproject/notation-go | 0 |
| chainguard | zot | 0 |
| chainguard | kyverno | 0 |
| wolfi | zot | 0 |
| notaryproject | notation-go | 1.0.0-rc.3 |
| wolfi | kyverno | 0 |
Timeline
- Feb 20, 2023 CVE Published
- Feb 21, 2023 EPSS Score (30 in total, the first dated here)
- Mar 17, 2026 Security Advisory
- Jun 17, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2023-25656
vulnetix vdb fixes CVE-2023-25656Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-25656/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart