MEDIUM5.3Go
GHSA-273p-m2cw-6833· CVE-2026-23831, GO-2026-4354Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty Message
Modified: 9/10/2026
package
Go/github.com/sigstore/rekor
pkg:go/github.com/sigstore/rekor
HIGH7.5Go
GHSA-2h5h-59f5-c5x9· CVE-2023-30551, GO-2023-1754Rekor's compressed archives can result in OOM conditions
Modified: 9/10/2026
HIGH7.5Go
GHSA-47q9-m4ww-924m· CVE-2026-48702, GO-2026-5778Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic
Modified: 9/10/2026
MEDIUM5.3Go
GHSA-4c4x-jm2x-pf9j· CVE-2026-24117, GO-2026-4355Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL
Modified: 9/10/2026
MEDIUM5.3Go
GHSA-frqx-jfcm-6jjr· CVE-2023-33199, GO-2023-1795malformed proposed intoto entries can cause a panic
Modified: 9/10/2026
—Go
GO-2023-1754· CVE-2023-30551, GHSA-2h5h-59f5-c5x9Rekor's compressed archives can result in OOM conditions in github.com/sigstore/rekor
Modified: 2/4/2026
—Go
GO-2023-1795· CVE-2023-33199, GHSA-frqx-jfcm-6jjrmalformed proposed intoto entries can cause a panic in github.com/sigstore/rekor
Modified: 2/4/2026
—Go
GO-2026-4354· CVE-2026-23831, GHSA-273p-m2cw-6833Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty Message in github.com/sigstore/rekor
Modified: 2/4/2026
—Go
GO-2026-4355· CVE-2026-24117, GHSA-4c4x-jm2x-pf9jRekor affected by Server-Side Request Forgery (SSRF) via provided public key URL in github.com/sigstore/rekor
Modified: 2/4/2026
—Go
GO-2026-5778· CVE-2026-48702, GHSA-47q9-m4ww-924mRekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic in github.com/sigstore/rekor
Modified: 7/8/2026