Skip to content
OpenAdvisories

Package · Go

github.com/sigstore/rekor

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-48702

    Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

    Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers …

    sigstore rekor github.com/sigstore/rekor rekor Debian Ubuntu Go
  • High 7.5
    CVE-2023-30551

    Rekor's compressed archives can result in OOM conditions

    Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions caused by reading archive metadata files into memory without checking their sizes first. Verification of a JAR file su…

    sigstore rekor github.com/sigstore/rekor rekor Alpine Go