CVE-2023-33957

notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation inspect command on the same machine. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation packages to v1.0.0-rc.6 or above. Users are advised to upgrade. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries.

• CWE-400

• https://github.com/notaryproject/notation/commit/ed22fde52f6d70ae0b53521bd28c9ccafa868c24Patch
• https://github.com/notaryproject/notation/security/advisories/GHSA-9m3v-v4r5-ppx7Vendor Advisory
• https://github.com/notaryproject/notation/commit/ed22fde52f6d70ae0b53521bd28c9ccafa868c24Patch
• https://github.com/notaryproject/notation/security/advisories/GHSA-9m3v-v4r5-ppx7Vendor Advisory

Published

Jun 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-33950Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.7…7.5
• CVE-2023-33951A race condition vulnerability was found in the vmwgfx drive…5.3
• CVE-2023-33952A double-free vulnerability was found in handling vmw_buffer…6.7
• CVE-2023-33953gRPC contains a vulnerability that allows hpack table accoun…7.5
• CVE-2023-33955Minio Console is the UI for MinIO Object Storage. Unicode RI…5.3
• CVE-2023-33956Kanboard is open source project management software that foc…6.5
• CVE-2023-33958notation is a CLI tool to sign and verify OCI artifacts and …6.5
• CVE-2023-33959notation is a CLI tool to sign and verify OCI artifacts and …8.8
• CVE-2023-3396A vulnerability was found in Campcodes Retro Cellphone Onlin…6.5
• CVE-2023-33960OpenProject is web-based project management software. For an…7.5
• CVE-2023-33961Leantime is a lean open source project management system. St…5.4
• CVE-2023-33962JStachio is a type-safe Java Mustache templating engine. Pr…6.1