rekor

Rekor Rekór —— 希腊语，意为“记录” Rekor 的目标是提供一个不可变且防篡改的分类账，用于记录软件项目供应链中生成的元数据。 Rekor 将使软件维护者和构建系统能够将签名的元数据记录到不可变的记录中。 其他方随后可以查询所述元数据，以便就对象生命周期的信任和不可否认性做出明智的决策。更多详情请访问 sigstore 网站。 Rekor 项目提供了一个基于 RESTful API 的验证服务器，以及一个用于存储的透明日志。 还提供了一个 CLI 应用程序，用于创建和验证条目、查询透明日志以获取包含证明、 对透明日志进行完整性验证，或通过公钥或工件检索条目。 Rekor...

CLEANSTART-2026-HZ27786 Security fixes in rekor-backfill-index 1.2.2-r0

Package rekor-backfill-index version 1.2.2-r0 fixes 7 vulnerabilities: CVE-2026-56864, CVE-2026-56865, CVE-2024-6104, ghsa-pmwq-pjrm-6p5r, CVE-2026-2303...

CLEANSTART-2026-QY94875 Security fixes in rekor-backfill-index 1.4.3-r0

Package rekor-backfill-index version 1.4.3-r0 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...

CLEANSTART-2026-ME27346 Security fixes in rekor-backfill-index 1.4.3-r1

Package rekor-backfill-index version 1.4.3-r1 fixes 1 vulnerabilities: ghsa-fcv2-xgw5-pqxf...

CLEANSTART-2026-EN93855 Security fixes in rekor-backfill-index 1.4.3-r2

Package rekor-backfill-index version 1.4.3-r2 fixes 3 vulnerabilities: ghsa-fw7p-63qq-7hpr, CVE-2026-26958, ghsa-mqqf-5wvp-8fh8...

BIT-COSIGN-2026-22703 Cosign verification accepts any valid Rekor entry under certain conditions

Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature or public key. When verifying a Rekor...

GO-2025-3540 vulnerabilities

Vulnerabilities for packages: traefik-fips, falcosidekick, juicefs, dapr, dapr-fips, keda, atlantis, falcosidekick-fips, gitea-fips, fluent-bit-plugin-loki, argo-cd-fips, opentelemetry-collector-contrib-fips, loki, rekor-fips, oauth2-proxy, splunk-otel-collector-fips, splunk-otel-collector, kots,...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: tkn-fips, tflint, trivy-operator, trivy-operator-fips, tkn, tekton-chains-fips, kyverno-notation-aws, ratify-fips, falcoctl-fips, chainctl, sigstore-scaffolding, gh, neuvector-sigstore-interface-fips, cg, goreleaser, reports-server, slsa-verifier, witness, zot,...

GO-2026-4348 vulnerabilities

Vulnerabilities for packages: tkn-fips, tflint, trivy-operator, trivy-operator-fips, tkn, tekton-chains-fips, kyverno-notation-aws, ratify-fips, falcoctl-fips, chainctl, sigstore-scaffolding, gh, neuvector-sigstore-interface-fips, cg, goreleaser, reports-server, slsa-verifier, witness, zot,...

GO-2024-3166 vulnerabilities

Vulnerabilities for packages: tkn-fips, melange, tkn, tekton-chains-fips, apko, chainctl, falcoctl-fips, sigstore-scaffolding, neuvector-sigstore-interface-fips, gh, slsa-verifier, zot, sigstore-scaffolding-fips, zarf, flux-source-controller, flux-source-controller-fips, policy-controller, trivy,...

GO-2024-2883 vulnerabilities

Vulnerabilities for packages: timestamp-authority, rekor, cortex, prometheus-alertmanager, grafana-mimir, fulcio...

GO-2026-4394 vulnerabilities

Vulnerabilities for packages: vault-env, ksops, policy-controller, headlamp, dagger, fluent-operator, grafana-image-renderer, cluster-api-azure-controller, cerbos, k3d, hydra, metrics-server, tfsec, azure-workload-identity-webhook, kyverno-notation-aws, k8sgpt, kine, src, restic, spicedb, thanos,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: wal-g, step, ksops, goreleaser, policy-controller, argo-events, cortex, harbor-registry, sigstore-scaffolding, grafana-agent-operator, boring-registry, rook, flyte, terragrunt, zot, falcoctl, timestamp-authority, trino, sqlpad, sops, spire-server, nuclei, rekor,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: aactl, dex, gitsign, oauth2-proxy, terragrunt, sops, spire-server, rekor, tekton-chains, slsa-verifier, flux-source-controller, cloudflared, kubescape, kots, vexctl, tkn, argo-workflows, flux-kustomize-controller, cosign, fulcio...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, goreleaser, aactl, policy-controller, gitsign, sigstore-scaffolding, zot, falcoctl, trivy-operator, spire-server, rekor, tekton-chains, kyverno-notation-aws, teleport, gh, slsa-verifier, flux-source-controller, kubescape, witness, vexctl...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, ksops, goreleaser, kubernetes-event-exporter, aactl, policy-controller, argo-events, flux-image-automation-controller, gitsign, sigstore-scaffolding, rook, crossplane-provider-family-azure, terragrunt, zot,...

CVE-2026-48702

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size...

CVE-2026-48702 Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size...

CVE-2026-48702

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size...

CVE-2026-48702

CVE-2026-48702 : Rekor before 1.5.2 decompresses APK signatures in Alpine APK parsing without bounding the total decompressed size, enabling a decompression bomb via gzip with extreme ratios. Attackers can trigger unbounded heap allocation during requests to unauthenticated endpoints POST /api/v1...