# CVE-2026-48702: Sigstore Rekor OOM via unbounded decompression in Alpine APK parsing

Source: https://junglewise.ai/threats/cve-2026-48702-sigstore-rekor-oom-via-unbounded-decompression-in-alpine-apk  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-13. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-48702 · Severity: high · CVSS 7.5 · Published 2026-08-13

Rekor, a transparency log service used for software supply chain security, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted Alpine Linux package (APK) that expands to a massive size when processed, causing the server to run out of memory and crash. This can disrupt the availability of the signature verification service, potentially halting software deployment pipelines.

Technologies: [github.com/sigstore/rekor (Go)](https://junglewise.ai/threats/technologies/github-com-sigstore-rekor). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Sigstore](https://junglewise.ai/threats/vendors/sigstore).

## Quick answers

**Is CVE-2026-48702 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48702 being exploited in the wild.

**How severe is CVE-2026-48702?** High severity, with a CVSS score of 7.5, published 13 August 2026.

**Which products and versions are affected?** github.com/sigstore/rekor (Go) >= 0.3.0, < 1.5.2, SEMVER:introduced=0.3.0,fixed=1.5.2; Sigstore Rekor >= 0.3.0, < 1.5.2.

**Is there a fix for CVE-2026-48702?** Yes. github.com/sigstore/rekor (Go): upgrade to 1.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48702 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-48702?** Check whether you run github.com/sigstore/rekor (Go) or Sigstore Rekor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/sigstore/rekor (Go): upgrade to 1.5.2 or later

  ```sh
  go get github.com/sigstore/rekor@v1.5.2
  ```


## Technical details

The Package.Unmarshal() function in pkg/types/alpine/apk.go decompresses gzip-compressed signature and control members of an APK file into memory without size limits. While a max_apk_metadata_size check exists, it is only applied after decompression is complete, allowing a 'decompression bomb' (e.g., 2MB compressed to 2GB decompressed) to exhaust heap memory. The vulnerability is reachable via unauthenticated POST requests to /api/v1/log/entries and /api/v1/log/entries/retrieve. An exploit triggers a fatal Go runtime OOM error or OS OOM-kill that bypasses standard recovery middleware. The issue is fixed in Rekor version 1.5.2.

## Affected products

- Sigstore Rekor >= 0.3.0, < 1.5.2

## Identifiers

- CVE-2026-48702
- GHSA-47q9-m4ww-924m
- GO-2026-5778

## Timeline

- 2026-05-26: disclosed: Initial disclosure by Hayden-IO
- 2026-06-25: advisory: GitHub Advisory published
- 2026-05-26: patched: Fix released in version 1.5.2

## References

- [https://github.com/sigstore/rekor/security/advisories/GHSA-47q9-m4ww-924m](https://github.com/sigstore/rekor/security/advisories/GHSA-47q9-m4ww-924m)
- [https://api.github.com/repos/sigstore/rekor/security-advisories/GHSA-47q9-m4ww-924m](https://api.github.com/repos/sigstore/rekor/security-advisories/GHSA-47q9-m4ww-924m)

## Related threats

- [GO-2026-4355 - Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL in github.com/sigstore/rekor](https://junglewise.ai/threats/cve-2026-24117-rekor-affected-by-server-side-request-forgery-ssrf-via-provided)
- [Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty Message](https://junglewise.ai/threats/cve-2026-23831-rekor-s-cose-v0-0-1-entry-type-nil-pointer-dereference-in)
- [GO-2023-1795 - malformed proposed intoto entries can cause a panic in github.com/sigstore/rekor](https://junglewise.ai/threats/cve-2023-33199-malformed-proposed-intoto-entries-can-cause-a-panic)
- [GO-2023-1754 - Rekor's compressed archives can result in OOM conditions in github.com/sigstore/rekor](https://junglewise.ai/threats/cve-2023-30551-rekor-s-compressed-archives-can-result-in-oom-conditions)