rekor vulnerabilities

2 known vulnerabilities in rekor from Sigstore. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  rekor: Allocation of Resources Without Limits or Throttling

  CVE-2026-48702Aug 13, 2026Sigstore

  Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers w

• 7.5 High severity

  rekor: Allocation of Resources Without Limits or Throttling

  CVE-2023-30551May 8, 2023SigstoreEPSS 1.05%

  Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions caused by reading archive metadata files into memory without checking their sizes first. Verification of a JAR file sub