Skip to content
Fencer Vulns
high 7.5

CVE-2026-48702 json

Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

published 2026-06-25 4 mo ago modified 2026-10-23 16 d ago also GHSA-47q9-m4ww-924m , GO-2026-5778 , EUVD-2026-57928

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 40%
public exploits
0
none known

Summary

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size. The existing `max_apk_metadata_size` check (default 1MB) is only applied to individual tar entry header sizes after decompression completes, so it does not prevent a decompression bomb from consuming unbounded heap memory. An attacker can craft a gzip stream that compresses at a ~1000:1 ratio (e.g., 2MB compressed zeros → 2GB decompressed). When submitted as spec.package.content in an Alpine `ProposedEntry`, the server decompresses the full payload into memory during request processing, triggering a fatal Go runtime out-of-memory error or OS OOM-kill that cannot be caught by the server's recover() middleware. This is reachable via two unauthenticated endpoints, `POST /api/v1/log/entries (createLogEntry)` and `POST /api/v1/log/entries/retrieve (searchLogQuery)`. Both invoke `V001Entry.Canonicalize()` → `fetchExternalEntities()` → `apk.Unmarshal(packageData)`, which performs the unbounded decompression. Version 1.5.2 patches the issue. There is no effective workaround. Setting `max_request_body_size` reduces but does not eliminate exposure due to the ~1000:1 compression ratio (a 1MB body limit still allows ~1GB heap allocation). Setting `max_apk_metadata_size` has no effect on this vulnerability since the check is applied after decompression.

Patch / fix

  • go github.com/sigstore/rekor 1.5.2
  • rekor Debian 14 1.5.2-1

debian advisories DEBIAN-CVE-2026-48702

  • trivy hummingbird 1 0.72.0-0.1.hum1
  • cosign hummingbird 1 3.1.1-0.1.hum1

red hat advisories RHSA-2026:35111RHSA-2026:25138

  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
  • tekton-cli openSUSE Tumbleweed 0.45.1-1.1
  • hauler openSUSE Leap 16.0 2.0.1-bp160.1.1
  • hauler openSUSE Tumbleweed 2.0.1-1.1

opensuse advisories openSUSE-SU-2026:21483-1openSUSE-SU-2026:11398-1openSUSE-SU-2026:21262-1openSUSE-SU-2026:11154-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-48702 updated cvss 7.5

github.com/sigstore/rekor: Rekor: Denial of Service due to unbounded gzip decompression in Alpine APK parsing

  • Red Hat Multicluster Engine for Kubernetes multicluster-engine/assisted-service-9-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Trusted Artifact Signer rekor
    affected: workaround, no fix available
  • Red Hat Hardened Images cosign 3.1.1-0.1.hum1, trivy 0.72.0-0.1.hum1
    fixed: vendor fix RHSA-2026:25138
  • Red Hat Trusted Artifact Signer 1.3 rhtas/rekor-server-rhel9 1787305397
    fixed: vendor fix RHSA-2026:59439
  • Red Hat Trusted Artifact Signer 1.4 rhtas/rekor-server-rhel9 1785391524
    fixed: vendor fix RHSA-2026:50873
  • Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 assisted/agent-preinstall-image-builder-rhel9 Red Hat Confidential Compute Attestation openshift-sandboxed-containers/osc-must-gather-rhel9 Red Hat Lightspeed Core lightspeed-core/rag-tool-cpu-rhel9, lightspeed-core/rag-tool-cuda-12.9-rhel9 Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/cluster-logging-rhel9-operator Red Hat Logical Volume Manager Storage lvms4/lvms-must-gather-rhel9 Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-log-reader-rhel8, rhmtc/openshift-migration-must-gather-rhel8
    +29 more products
    Red Hat Migration Toolkit for Virtualization mtv-candidate/mtv-must-gather-rhel8, migration-toolkit-virtualization/mtv-must-gather-rhel8, migration-toolkit-virtualization/mtv-must-gather-rhel9 Red Hat Multicluster Engine for Kubernetes multicluster-engine/must-gather-rhel9, multicluster-engine/assisted-service-8-rhel8, multicluster-engine/assisted-installer-controller-rhel8, multicluster-engine/assisted-installer-controller-rhel9 Red Hat Node HealthCheck Operator workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift API for Data Protection oadp/oadp-mustgather-rhel9, oadp/oadp-velero-plugin-rhel9 Red Hat OpenShift Developer Tools and Services ocp-tools-4/jenkins-rhel8, ocp-tools-4/jenkins-rhel9, ocp-tools-4/jenkins-agent-base-rhel8, ocp-tools-4/jenkins-agent-base-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-agentic-sandbox-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-opc-rhel9, openshift-pipelines/pipelines-cli-tkn-rhel8, openshift-pipelines/pipelines-cli-tkn-rhel9, openshift-pipelines/pipelines-rhel9-operator, openshift-pipelines/pipelines-chains-controller-rhel8, openshift-pipelines/pipelines-chains-controller-rhel9 Red Hat OpenShift Serverless openshift-serverless-1/kn-plugin-event-sender-rhel9, openshift-serverless-1/serverless-must-gather-rhel9 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/istio-must-gather-rhel9 Red Hat Pen Drive Powered by Red Hat Lightspeed pen-drive/pen-drive-scanner-rhel9 Red Hat Power monitoring for Red Hat OpenShift openshift-power-monitoring/power-monitoring-rhel9-operator Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/acm-must-gather-rhel9, rhacm2/submariner-rhel9-operator Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-main-rhel9, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-roxctl-rhel9, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-rhel9-operator, +3 more Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/ee-supported-rhel9, ansible-automation-platform-25/aap-must-gather-rhel8, ansible-automation-platform-26/aap-must-gather-rhel9, ansible-automation-platform-27/aap-must-gather-rhel9, ansible-automation-platform-26/platform-resource-runner-rhel9, ansible-automation-platform-tech-preview/ansible-devspaces-rhel9 Red Hat Developer Hub 1 rhdh/rhdh-must-gather-rhel9 Red Hat Enterprise Linux 9 rhel9-eus/rhel-9.6-bootc Red Hat Enterprise Linux 10 buildah 1.39.9-1.el10_0, podman 5.4.0-15.el10_0.2, skopeo 1.18.1-3.el10_0.2, rhel10-eus/rhel-10.0-bootc Red Hat OpenShift AI (RHOAI) rhoai/rhai-cli-rhel9, rhoai/odh-must-gather-rhel9, rhoai/odh-th06-cpu-torch291-py312-rhel9, rhoai/odh-th06-cuda130-torch291-py312-rhel9, rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9, +16 more Red Hat OpenShift Container Platform 4 openshift4/ose-cli, openshift4/ose-tests, openshift-kni/commatrix, openshift4/ose-deployer, openshift4/ose-cli-rhel9, openshift4/cnf-tests-rhel8, +34 more Red Hat OpenShift Container Platform 5 openshift-kni/commatrix, openshift5/cnf-tests-rhel9, openshift5/oc-mirror-plugin-rhel9, openshift5/ose-docker-builder-rhel9, openshift5/lifecycle-agent-rhel9-operator, openshift5/numaresources-must-gather-rhel9, +2 more Red Hat Openshift Data Foundation 4 odf4/mcg-core-rhel9, odf4/odf-must-gather-rhel9, odf4/odf-cloudnative-pg-rhel9-operator Red Hat OpenShift Dev Spaces devspaces/udi-rhel9 Red Hat OpenShift GitOps openshift-gitops-1/must-gather-rhel8, openshift-gitops-1/must-gather-rhel9 Red Hat OpenShift Virtualization 4 container-native-virtualization/cnv-must-gather-rhel9, container-native-virtualization/ocp-virt-validation-checkup-rhel9 Red Hat OpenStack Platform 18.0 rhoso-operators/openstack-operator-bundle, rhoso-operators/prometheus-podman-exporter-rhel9 Red Hat Quay 3 quay/quay-builder-rhel9 Red Hat Trusted Artifact Signer rhtas/ec-rhel9, rhtas/cosign-rhel9, rhtas/gitsign-rhel9, rhtas/rekor-cli-rhel9, rhtas/ctlog-monitor-rhel9, rhtas/rekor-monitor-rhel9, +6 more Red Hat Trusted Artifact Signer 1.3 rhtas/fulcio-rhel9 1787305413, rhtas/trillian-redis-rhel9 1787305441, rhtas/rekor-search-ui-rhel9 1787305549, rhtas/trillian-database-rhel9 1787305441, rhtas/trillian-logserver-rhel9 1787305441, rhtas/trillian-logsigner-rhel9 1787305441, +3 more Red Hat Trusted Artifact Signer 1.4 rhtas/fulcio-rhel9 1785391594, rhtas/trillian-redis-rhel9 1785391426, rhtas/rekor-search-ui-rhel9 1785391462, rhtas/trillian-database-rhel9 1785314167, rhtas/trillian-logserver-rhel9 1785391426, rhtas/trillian-logsigner-rhel9 1785391426, +3 more
    not affected: vulnerable code not present

3 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.46% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/sigstore/rekor
>=0.3.0, <1.5.2
1.5.2

Affected products

  • sigstore rekor

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.