Executive brief
Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL in github.com/sigstore/rekor
Affected products
- Go github.com/sigstore/rekor
Junglewise Threat Intelligence
CVE-2026-24117: GO-2026-4355 - Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL in github.com/sigstore/rekor
CVE-2026-24117 · Severity: low · CVSS 3.1 · Published 2026-02-02
Technologies: github.com/sigstore/rekor (Go). Vendors: Go.
Related threats
- Sigstore Rekor OOM via unbounded decompression in Alpine APK parsing
- GO-2026-4354 - Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty Message in github.com/sigstore/rekor
- GO-2023-1795 - malformed proposed intoto entries can cause a panic in github.com/sigstore/rekor
- GO-2023-1754 - Rekor's compressed archives can result in OOM conditions in github.com/sigstore/rekor