CVE-2026-48702
Received Received - Intake

BaseFortify

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description
Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size. The existing `max_apk_metadata_size` check (default 1MB) is only applied to individual tar entry header sizes after decompression completes, so it does not prevent a decompression bomb from consuming unbounded heap memory. An attacker can craft a gzip stream that compresses at a ~1000:1 ratio (e.g., 2MB compressed zeros → 2GB decompressed). When submitted as spec.package.content in an Alpine `ProposedEntry`, the server decompresses the full payload into memory during request processing, triggering a fatal Go runtime out-of-memory error or OS OOM-kill that cannot be caught by the server's recover() middleware. This is reachable via two unauthenticated endpoints, `POST /api/v1/log/entries (createLogEntry)` and `POST /api/v1/log/entries/retrieve (searchLogQuery)`. Both invoke `V001Entry.Canonicalize()` → `fetchExternalEntities()` → `apk.Unmarshal(packageData)`, which performs the unbounded decompression. Version 1.5.2 patches the issue. There is no effective workaround. Setting `max_request_body_size` reduces but does not eliminate exposure due to the ~1000:1 compression ratio (a 1MB body limit still allows ~1GB heap allocation). Setting `max_apk_metadata_size` has no effect on this vulnerability since the check is applied after decompression.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-48702
EUVD
EUVD-2026-57928

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sigstore rekor From 0.3.0 (inc) to 1.5.2 (exc)
sigstore rekor 1.5.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Rekor allows an attacker to craft a specially designed APK file that, when processed, causes the server to decompress an extremely large amount of data into memory. The decompression is unbounded, meaning it can consume massive heap memory, leading to a system crash due to out-of-memory errors.

Detection Guidance

This vulnerability is specific to Rekor versions 0.3.0 to 1.5.1 and can be detected by checking the installed version of Rekor. Run: rekor-server --version. If the version is within the vulnerable range, the system is exposed. Monitor for crashes or out-of-memory errors during APK file processing.

Impact Analysis

If exploited, this vulnerability can cause the Rekor server to crash, disrupting service availability. It may also lead to denial-of-service conditions, where the server becomes unresponsive or requires a restart, affecting users relying on the software supply chain transparency log.

Mitigation Strategies

Upgrade Rekor to version 1.5.2 or later immediately. There is no effective workaround. Avoid processing untrusted APK files until patched. Set strict request size limits as a temporary measure, but note this does not fully mitigate the risk.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48702. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart