CVE-2026-48702 sigstore CVE debrief

Who should care

Defenders responsible for Rekor instances, as well as security teams monitoring for potential DoS attacks, should be aware of this vulnerability and prioritize patching to version 1.5.2.

Why it matters

CVE-2026-48702 is a high-severity vulnerability in Rekor that allows for potential DoS attacks. Defenders should prioritize patching to version 1.5.2 and consider limiting max_request_body_size to reduce exposure.

• Potential for denial-of-service (DoS) attacks leading to fatal Go runtime out-of-memory errors or OS OOM-kill
• Unbounded decompression of malicious APK files
• Exposure via two unauthenticated endpoints

Technical summary

The vulnerability exists in the Package.Unmarshal() function in pkg/types/alpine/apk.go, which decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size. This allows an attacker to craft a gzip stream that compresses at a ~1000:1 ratio, leading to a fatal Go runtime out-of-memory error or OS OOM-kill. The existing max_apk_metadata_size check (default 1MB) is only applied to individual tar entry header sizes after decompression completes, so it does not prevent a decompression bomb from consuming unbounded heap memory. An attacker can craft a malicious APK file to cause a denial-of-service (DoS) attack.

Defensive priority

Defenders should prioritize patching Rekor instances to version 1.5.2. Until patched, consider limiting max_request_body_size to reduce, but not eliminate, exposure.

Recommended defensive actions

• Patch Rekor instances to version 1.5.2
• Limit max_request_body_size to reduce exposure
• Monitor for potential DoS attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. A security advisory from GitHub also provides additional context. Defenders should verify affected scope, severity, and vendor guidance through official advisories. The vulnerability allows for potential DoS attacks leading to fatal Go runtime out-of-memory errors or OS OOM-kill. There is no effective workaround, but setting max_request_body_size reduces exposure. The CVE Program and NVD offer source-provied

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.