CVE-2024-29902

CVE-2024-29902 is a denial-of-service vulnerability affecting sigstore cosign versions prior to 2.2.4. A remote attacker can exploit this by providing a malicious, oversized attachment to an image, causing cosign to consume excessive memory and crash the host machine. This vulnerability has a CVSS score of 5.9 (Medium), indicating a network-based attack with high impact on availability and high attack complexity. There is currently no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.