Skip to content
OpenAdvisories

Package · Debian

rekor

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2026-48702

    Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

    Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers …

    sigstore rekor kubescape zarf Debian Ubuntu Wolfi Go