Threats affecting pkg:rpm/suse/cosign

A security update for cosign addresses CVE-2026-39395, which involves incorrect attestation verification caused by malformed payloads or mismatched predicate types. This vulnerability could affect the integrity of attestation processes. The update also includes a non-security version upgrade to 3.0.5. The severity of this issue is assessed as medium.