CVE-2023-25656

notation-go is a collection of libraries for supporting Notation sign, verify, push, and pull of oci artifacts. Prior to version 1.0.0-rc.3, notation-go users will find their application using excessive memory when verifying signatures. The application will be killed, and thus availability is impacted. The problem has been patched in the release v1.0.0-rc.3. Some workarounds are available. Users can review their own trust policy file and check if the identity string contains `=#`. Meanwhile, users should only put trusted certificates in their trust stores referenced by their own trust policy files, and make sure the `authenticity` validation is set to `enforce`.

• CWE-770
• CWE-770

• https://github.com/notaryproject/notation-go/releases/tag/v1.0.0-rc.3Release Notes
• https://github.com/notaryproject/notation-go/security/advisories/GHSA-87x9-7grx-m28vVendor Advisory
• https://github.com/notaryproject/notation-go/releases/tag/v1.0.0-rc.3Release Notes
• https://github.com/notaryproject/notation-go/security/advisories/GHSA-87x9-7grx-m28vVendor Advisory

Published

Feb 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-25650 There is an arbitrary file download vulnerability in ZXCLOU…6.5
• CVE-2023-25651 There is a SQL injection vulnerability in some ZTE mobile i…8
• CVE-2023-25652Git is a revision control system. Prior to versions 2.30.9, …7.5
• CVE-2023-25653node-jose is a JavaScript implementation of the JSON Object …7.5
• CVE-2023-25654baserCMS is a Content Management system. Prior to version 4.…9.8
• CVE-2023-25655baserCMS is a Content Management system. Prior to version 4.…9.8
• CVE-2023-25657Nautobot is a Network Source of Truth and Network Automation…9.8
• CVE-2023-25658TensorFlow is an open source platform for machine learning. …7.5
• CVE-2023-25659TensorFlow is an open source platform for machine learning. …7.5
• CVE-2023-2566Cross-site Scripting (XSS) - Stored in GitHub repository ope…4.8
• CVE-2023-25660TensorFlow is an open source platform for machine learning. …7.5
• CVE-2023-25661TensorFlow is an Open Source Machine Learning Framework. In …6.5