Executive brief
Rekor, a transparency log service used for software supply chain security, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted Alpine Linux package (APK) that expands to a massive size when processed, causing the server to run out of memory and crash. This can disrupt the availability of the signature verification service, potentially halting software deployment pipelines.
Technical details
The Package.Unmarshal() function in pkg/types/alpine/apk.go decompresses gzip-compressed signature and control members of an APK file into memory without size limits. While a max_apk_metadata_size check exists, it is only applied after decompression is complete, allowing a 'decompression bomb' (e.g., 2MB compressed to 2GB decompressed) to exhaust heap memory. The vulnerability is reachable via unauthenticated POST requests to /api/v1/log/entries and /api/v1/log/entries/retrieve. An exploit triggers a fatal Go runtime OOM error or OS OOM-kill that bypasses standard recovery middleware. The issue is fixed in Rekor version 1.5.2.
Affected products
- Sigstore Rekor >= 0.3.0, < 1.5.2
Timeline
- 2026-05-26: disclosed: Initial disclosure by Hayden-IO
- 2026-06-25: advisory: GitHub Advisory published
- 2026-05-26: patched: Fix released in version 1.5.2