CVE-2026-48702 sigstore CVE debrief

Who should care

Defenders responsible for deploying and managing Rekor instances should assess exposure and prioritize patching to prevent potential out-of-memory errors or OOM-kills. This includes reviewing the current deployment configurations, identifying instances with unauthenticated access to affected endpoints, and ensuring that patching is applied in a timely manner. Additionally, defenders should monitor Rekor instances for potential out-of-memory errors or OOM-k

Why it matters

CVE-2026-48702 is a high-severity vulnerability in Rekor that can lead to out-of-memory errors or OOM-kills. Defenders should prioritize patching Rekor instances to version 1.5.2 or later and assess exposure in environments where unauthenticated access to affected endpoints is possible.

• Potential out-of-memory errors or OOM-kills in Rekor instances
• Unauthenticated access to affected endpoints can lead to denial-of-service conditions
• Patching to version 1.5.2 or later is required to prevent exploitation

Technical summary

The `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size. This can lead to a fatal Go runtime out-of-memory error or OS OOM-kill when processed by the server. The existing `max_apk_metadata_size` check (default 1MB) is only applied to individual tar entry header sizes after decompression completes, so it does not prevent a decompression bomb from consuming unbounded heap memory. An attacker can craft a gzip stream that compresses at a ~1000:1 ratio (e.g., 2MB compressed zeros → 2GB decompressed). When submitted as spec.package.content in an Alpine `ProposedEntry`, the

Defensive priority

Defenders should prioritize patching Rekor instances to version 1.5.2 or later to prevent potential out-of-memory errors or OOM-kills. Assess exposure by checking if Rekor instances are deployed in environments where unauthenticated access to the affected endpoints is possible.

Recommended defensive actions

• Patch Rekor instances to version 1.5.2 or later
• Assess exposure by checking if Rekor instances are deployed in environments where unauthenticated access to the affected endpoints is possible
• Monitor Rekor instances for potential out-of-memory errors or OOM-kills
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. A security advisory from GitHub also provides additional context. Defenders should verify affected scope, severity, and vendor guidance through official advisories or CVE records. The vulnerability affects Rekor instances, particularly those with unauthenticated access to affected endpoints. Evidence limits suggest that defenders review compensating controls for exposed systems while remediation is scheduled

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.