What’s Vulnerable › Products

sigstore rekor vulnerabilities

5 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Check whether your sigstore rekor version is affected

Latest sigstore rekor vulnerabilities

• CVE-2026-48702 — Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic (CVSS 7.5)
• CVE-2026-24117 — Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL (CVSS 5.3)
• CVE-2026-23831 — Rekor COSE v0.0.1 Canonicalize crashes when passed empty Message (CVSS 5.3)
• CVE-2023-33199 — malformed proposed intoto v0.0.2 entries can cause a panic in Rekor (CVSS 5.3)
• CVE-2023-30551 — Rekor's compressed archives can result in OOM conditions (CVSS 7.5)