Is CVE-2026-48702 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48702 being exploited in the wild.

How severe is CVE-2026-48702?

High severity, with a CVSS score of 7.5, published 13 August 2026.

Which products and versions are affected?

github.com/sigstore/rekor (Go) >= 0.3.0, = 0.3.0, < 1.5.2.

Is there a fix for CVE-2026-48702?

Yes. github.com/sigstore/rekor (Go): upgrade to 1.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48702 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-48702?

Check whether you run github.com/sigstore/rekor (Go) or Sigstore Rekor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48702: Sigstore Rekor OOM via unbounded decompression in Alpine APK parsing

Q: Is there a fix for CVE-2026-48702?

Yes. github.com/sigstore/rekor (Go): upgrade to 1.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-48702 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-48702?

Check whether you run github.com/sigstore/rekor (Go) or Sigstore Rekor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48702 · Severity: high · CVSS 7.5 · Published 2026-08-13

Rekor, a transparency log service used for software supply chain security, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted Alpine Linux package (APK) that expands to a massive size when processed, causing the server to run out of memory and crash. This can disrupt the availability of the signature verification service, potentially halting software deployment pipelines.

Technologies: github.com/sigstore/rekor (Go). Vendors: Go, Sigstore.

Quick answers

Is CVE-2026-48702 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48702 being exploited in the wild.
How severe is CVE-2026-48702?: High severity, with a CVSS score of 7.5, published 13 August 2026.
Which products and versions are affected?: github.com/sigstore/rekor (Go) >= 0.3.0, < 1.5.2, SEMVER:introduced=0.3.0,fixed=1.5.2; Sigstore Rekor >= 0.3.0, < 1.5.2.
Is there a fix for CVE-2026-48702?: Yes. github.com/sigstore/rekor (Go): upgrade to 1.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48702 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-48702?: Check whether you run github.com/sigstore/rekor (Go) or Sigstore Rekor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/sigstore/rekor (Go): upgrade to 1.5.2 or later
```
go get github.com/sigstore/rekor@v1.5.2
```

Technical details

The Package.Unmarshal() function in pkg/types/alpine/apk.go decompresses gzip-compressed signature and control members of an APK file into memory without size limits. While a max_apk_metadata_size check exists, it is only applied after decompression is complete, allowing a 'decompression bomb' (e.g., 2MB compressed to 2GB decompressed) to exhaust heap memory. The vulnerability is reachable via unauthenticated POST requests to /api/v1/log/entries and /api/v1/log/entries/retrieve. An exploit triggers a fatal Go runtime OOM error or OS OOM-kill that bypasses standard recovery middleware. The issue is fixed in Rekor version 1.5.2.

Affected products

Sigstore Rekor >= 0.3.0, < 1.5.2

Identifiers

CVE-2026-48702
GHSA-47q9-m4ww-924m
GO-2026-5778

Timeline

2026-05-26: disclosed: Initial disclosure by Hayden-IO
2026-06-25: advisory: GitHub Advisory published
2026-05-26: patched: Fix released in version 1.5.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.