Skip to content
OpenAdvisories

Package · Debian

rekor

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 7.5
    CVE-2026-48702

    Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

    Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers …

    sigstore rekor github.com/sigstore/rekor rekor Debian Ubuntu Go
  • Medium 5.3
    CVE-2026-24117

    Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL

    Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index/retrieve supports retrieving a public key via user-provided URL. Since the SSRF only can trigger GE…

    sigstore rekor github.com/sigstore/rekor rekor Debian Ubuntu Go
  • Medium 5.3
    CVE-2026-23831

    Rekor COSE v0.0.1 Canonicalize crashes when passed empty Message

    Rekor is a software supply chain transparency log. In versions 1.4.3 and below, the entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty spec.message, causing nil Pointer Dereference. Function validate…

    sigstore rekor github.com/sigstore/rekor rekor Debian Ubuntu Go