GoSeverity: MediumStatus: Published

Untrusted (self-made) RFC 3161 timestamp sets the chain and revocation validation time, so expired or revoked signing certificates verify as Valid

An untrusted, self-made RFC 3161 timestamp set the time used for chain and revocation checks, so signatures from expired or revoked signing certificates could verify as Valid. Fixed in v1.0.0-rc5.

Timeline

6 October 2026 Found
7 October 2026 Reported via private vulnerability report
7 October 2026 Advisory published
7 October 2026 Entry last updated

Machine-readable: JSON · Markdown · ID security/go/digitorus__pdfsign/2026-10-06-untrusted-timestamp-sets-validation-time