GitHub Advisoryadvisory · Go

GHSA-r727-5pf6-47r2 Elastic Package Registry has Improper Verification of Cryptographic Signature

MEDIUM Published 2026-04-29 Modified 2026-05-06 Official page ↗
Aliases
CVE-2026-33467
Ecosystem
Go
Packages
github.com/elastic/package-registry
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-347
Reviewed
2026-05-06

Affected packages

• Go github.com/elastic/package-registry: < 1.38.0 → fixed in 1.38.0

Description

Improper Verification of Cryptographic Signature (CWE-347) in Elastic Package Registry could allow an attacker positioned to intercept network traffic, or to otherwise influence the contents served to a self-hosted registry, to substitute a tampered package without the integrity check failing closed.

Related

Alias · CVE (1)

  • CVE-2026-33467 Improper Verification of Cryptographic Signature (CWE-347) in Elastic Package Registry could allow an attacker positioned to intercept… vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References