Skip to content
OpenAdvisories

Package · Go

github.com/sigstore/rekor

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-24117

    Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL

    Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index/retrieve supports retrieving a public key via user-provided URL. Since the SSRF only can trigger GE…

    sigstore rekor github.com/sigstore/rekor rekor Debian Ubuntu Go
  • Medium 5.3
    CVE-2026-23831

    Rekor COSE v0.0.1 Canonicalize crashes when passed empty Message

    Rekor is a software supply chain transparency log. In versions 1.4.3 and below, the entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty spec.message, causing nil Pointer Dereference. Function validate…

    sigstore rekor github.com/sigstore/rekor rekor Debian Ubuntu Go
  • Medium 5.3
    CVE-2023-33199

    malformed proposed intoto v0.0.2 entries can cause a panic in Rekor

    Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the `intoto/v0.0.2` type can cause a panic on a thread within the Rekor process. The thread is recov…

    sigstore rekor github.com/sigstore/rekor Go