Description
Rekor is a software supply chain transparency log. In versions 1.4.3 and below, the entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty spec.message, causing nil Pointer Dereference. Function validate() returns nil (success) when message is empty, leaving sign1Msg uninitialized, and Canonicalize() later dereferences v.sign1Msg.Payload. A malformed proposed entry of the cose/v0.0.1 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This issue has been fixed in version 1.5.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sigstore | rekor | < 1.5.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rekor | 1.5.0-1 | — |
| Debian 13 | rekor | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rekor | No fix yet | — |
| Ubuntu 25.10 | rekor | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | rekor | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | rekor | 1.5.0-1.1 | openSUSE-SU-2026:10127-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20260205T172317-150000.1.146.1 | SUSE-SU-2026:0403-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | aactl | 0.4.12-r42 | — |
| Wolfi rolling | buildkitd | 0.27.1-r1 | — |
| Wolfi rolling | cosign | 3.0.4-r2 | — |
| Wolfi rolling | falcoctl | 0.12.2-r0 | — |
| Wolfi rolling | flux-source-controller | 1.7.4-r7 | — |
| Wolfi rolling | gh | 2.86.0-r0 | — |
| Wolfi rolling | gitsign | 0.14.0-r0 | — |
| Wolfi rolling | goreleaser | 2.13.3-r5 | — |
| Wolfi rolling | ko | 0.18.1-r2 | — |
| Wolfi rolling | kubescape | 3.0.48-r0 | — |
| Wolfi rolling | kyverno-notation-aws | 1.1-r32 | — |
| Wolfi rolling | neuvector-sigstore-interface | 0_git20251212-r3 | — |
| Wolfi rolling | policy-controller +1 | 0.15.1-r0 | — |
| Wolfi rolling | ratify | 1.4.0-r10 | — |
| Wolfi rolling | skaffold | 2.17.1-r4 | — |
| Wolfi rolling | slsa-verifier | 2.7.1-r8 | — |
| Wolfi rolling | spire-agent | 1.14.1-r2 | — |
| Wolfi rolling | tekton-chains | 0.26.0-r5 | — |
| Wolfi rolling | teleport-18.6 +1 | 18.6.8-r9 | — |
| Wolfi rolling | tflint | 0.60.0-r7 | — |
| Wolfi rolling | tkn | 0.43.0-r4 | — |
| Wolfi rolling | trivy | 0.68.2-r2 | — |
| Wolfi rolling | trivy-operator | 0.29.0-r7 | — |
| Wolfi rolling | vexctl | 0.4.1-r8 | — |
| Wolfi rolling | witness | 0.10.2-r4 | — |
| Wolfi rolling | zarf | 0.70.1-r3 | — |
| Wolfi rolling | zot | 2.1.14-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/sigstore/rekor | < 1.5.0 | 1.5.0 | GHSA-273p-m2cw-6833 |
Advisories 3
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- openSUSE-SU-2026:10127-1 rekor-1.5.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0403-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Mar 23, 2026