Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/sigstore/rekor

5 known vulnerabilities (2 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 2 high, 3 medium
Registry
pkg.go.dev

Advisories 5

  • Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

    Affected: from 0.3.0, fixed in 1.5.2.

  • CVE-2026-24117Medium 5.3

    Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL

    Affected: fixed in 1.5.0.

  • CVE-2026-23831Medium 5.3

    Rekor COSE v0.0.1 Canonicalize crashes when passed empty Message

    Affected: fixed in 1.5.0.

  • CVE-2023-33199Medium 5.3

    malformed proposed intoto v0.0.2 entries can cause a panic in Rekor

    Affected: fixed in 1.2.0.

  • Rekor's compressed archives can result in OOM conditions

    Affected: fixed in 1.1.1.