Description
Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions caused by reading archive metadata files into memory without checking their sizes first. Verification of a JAR file submitted to Rekor can cause an out of memory crash if files within the META-INF directory of the JAR are sufficiently large. Parsing of an APK file submitted to Rekor can cause an out of memory crash if the .SIGN or .PKGINFO files within the APK are sufficiently large. The OOM crash has been patched in Rekor version 1.1.1. There are no known workarounds.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sigstore | rekor | < 1.1.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | rekor | 1.1.1-150400.4.9.1 | SUSE-SU-2023:2210-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | rekor | 1.1.1-2.1 | openSUSE-SU-2024:12919-1 |
| openSUSE Leap 15.4 | rekor | 1.1.1-150400.4.9.1 | SUSE-SU-2023:2210-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | rekor | 1.1.1-r0 | — |
| Alpine v3.23 | rekor | 1.1.1-r0 | — |
| Alpine v3.22 | rekor | 1.1.1-r0 | — |
| Alpine v3.21 | rekor | 1.1.1-r0 | — |
| Alpine v3.20 | rekor | 1.1.1-r0 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | rekor | 1.1.1-r0 | — |
| Alpine v3.18 | rekor | 1.1.1-r0 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | aactl | 0.4.12-r7 | — |
| Wolfi rolling | apko | 0.8.0-r1 | — |
| Wolfi rolling | ko | 0.13.0-r3 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/sigstore/rekor | < 1.1.1 | 1.1.1 | GHSA-2h5h-59f5-c5x9 |
Advisories 2
- openSUSE-SU-2024:12919-1 rekor-1.1.1-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2210-1 Security update for rekor SUSE / openSUSE Security Updates · Feb 4, 2026