CVE-2026-23831
MediumCVSS 5.3Summary
In Rekor (a software supply chain transparency log) versions 1.4.3 and below, the entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty spec.message, causing a nil pointer dereference. The validate() function returns nil (success) when the message is empty, leaving sign1Msg uninitialized, and Canonicalize() later dereferences v.sign1Msg.Payload. A malformed proposed entry of the cose/v0.0.1 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error and the service continues, so the availability impact is minimal. This issue has been fixed in version 1.5.0.
Risk Assessment
An attacker can trigger a panic in the Rekor process, causing 500 errors and potential disruption in request handling, though the service remains available. The risk to the organization is low but may lead to false alarms and operational overhead.
Recommendation
Update Rekor to version 1.5.0 or later, which contains the fix. Monitor logs for 500 errors related to malformed cose/v0.0.1 entries.
Other vulnerabilities in Rekor
See all- CVE-2026-24117Medium
Rekor versions 1.4.3 and below allow SSRF to arbitrary internal services because /api/v1/index/retrieve supports retrieving a public key via a user-provided URL. The SSRF can only trigger GET requests, cannot mutate state, and the response is not returned, so only blind SSRF (internal network probing) is possible.
- CVE-2026-48702High
Rekor, a software supply chain transparency log, contains a decompression bomb vulnerability in the `Package.Unmarshal()` function for APK files. An attacker can submit a specially crafted APK file that decompresses to a huge amount of memory, causing a server crash. The vulnerability affects versions 0.3.0 through 1.5.1 and is reachable via two unauthenticated endpoints.
- CVE-2023-33199Medium
The vulnerability in Rekor allows a malformed entry of type `intoto/v0.0.2` to cause a panic in a thread within the Rekor process. However, the service continues to run, and the client receives a 500 error message.
Original NVD description (English source)
Rekor is a software supply chain transparency log. In versions 1.4.3 and below, the entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty spec.message, causing nil Pointer Dereference. Function validate() returns nil (success) when message is empty, leaving sign1Msg uninitialized, and Canonicalize() later dereferences v.sign1Msg.Payload. A malformed proposed entry of the cose/v0.0.1 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This issue has been fixed in version 1.5.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS