CVE-2026-23831

NameCVE-2026-23831
DescriptionRekor is a software supply chain transparency log. In versions 1.4.3 and below, the entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty spec.message, causing nil Pointer Dereference. Function validate() returns nil (success) when message is empty, leaving sign1Msg uninitialized, and Canonicalize() later dereferences v.sign1Msg.Payload. A malformed proposed entry of the cose/v0.0.1 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This issue has been fixed in version 1.5.0.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1126275

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
rekor (PTS)trixie1.3.9-1vulnerable
forky, sid1.4.3-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
rekorsource(unstable)(unfixed)1126275

Notes

https://github.com/sigstore/rekor/security/advisories/GHSA-273p-m2cw-6833
Fixed by: https://github.com/sigstore/rekor/commit/39bae3d192bce48ef4ef2cbd1788fb5770fee8cd (v1.5.0)

Search for package or bug name: Reporting problems