Copyright © 2012 Red Hat, Inc. All rights reserved.
Important
2026-06-25T21:33:36
github.com/sigstore/rekor: Rekor: Denial of Service due to unbounded gzip decompression in Alpine APK parsing
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770
A flaw was found in Rekor. The `Package.Unmarshal()` function, which processes Alpine Package Keep (APK) files, decompresses gzip streams without limiting the total decompressed size. A remote attacker can exploit this by crafting a malicious APK file with a high compression ratio, causing the server to consume excessive memory. This leads to a Denial of Service (DoS) through an out-of-memory (OOM) error, and can be triggered via unauthenticated API endpoints.
A flaw was found in Rekor, a transparency log for supply chain security. The Alpine APK parsing logic decompresses gzip members without bounding total decompressed size, allowing a decompression bomb to cause out-of-memory conditions via unauthenticated API endpoints. This vulnerability is server-side only, affecting the Rekor server's APK entry processing. Products that import github.com/sigstore/rekor as a Go client library are not affected, as the vulnerable code path (Package.Unmarshal in pkg/types/alpine/apk.go) is only reachable through the Rekor server's HTTP API handlers.
There is no effective workaround. Setting max_request_body_size reduces but does not eliminate exposure due to the ~1000:1 compression ratio (a 1MB body limit still allows ~1GB heap allocation). Setting max_apk_metadata_size has no effect on this vulnerability since the check is applied after decompression.
Upgrade to Rekor 1.5.2 or later.
Red Hat Hardened Images
2026-06-10T00:00:00Z
RHSA-2026:25138
cosign-main-3.1.1-0.1.hum1
Assisted Installer for Red Hat OpenShift Container Platform 2
Not affected
assisted/agent-preinstall-image-builder-rhel9
Confidential Compute Attestation
Not affected
openshift-sandboxed-containers/osc-must-gather-rhel9
Lightspeed Core
Not affected
lightspeed-core/rag-tool-cpu-rhel9
Lightspeed Core
Not affected
lightspeed-core/rag-tool-cuda-12.9-rhel9
Logging Subsystem for Red Hat OpenShift
Not affected
openshift-logging/cluster-logging-rhel9-operator
Logical Volume Manager Storage
Not affected
lvms4/lvms-must-gather-rhel9
Migration Toolkit for Containers
Not affected
rhmtc/openshift-migration-controller-rhel8
Migration Toolkit for Containers
Not affected
rhmtc/openshift-migration-log-reader-rhel8
Migration Toolkit for Containers
Not affected
rhmtc/openshift-migration-must-gather-rhel8
Migration Toolkit for Virtualization
Not affected
migration-toolkit-virtualization/mtv-must-gather-rhel8
Migration Toolkit for Virtualization
Not affected
migration-toolkit-virtualization/mtv-must-gather-rhel9
Migration Toolkit for Virtualization
Not affected
mtv-candidate/mtv-must-gather-rhel8
Multicluster Engine for Kubernetes
Not affected
multicluster-engine/assisted-installer-controller-rhel8
Multicluster Engine for Kubernetes
Not affected
multicluster-engine/assisted-installer-controller-rhel9
Multicluster Engine for Kubernetes
Not affected
multicluster-engine/assisted-service-8-rhel8
Multicluster Engine for Kubernetes
Under investigation
multicluster-engine/assisted-service-9-rhel9
Multicluster Engine for Kubernetes
Not affected
multicluster-engine/must-gather-rhel9
Node HealthCheck Operator
Not affected
workload-availability/node-healthcheck-must-gather-rhel9
OpenShift API for Data Protection
Not affected
oadp/oadp-mustgather-rhel9
OpenShift API for Data Protection
Not affected
oadp/oadp-velero-plugin-rhel9
OpenShift Developer Tools and Services
Not affected
ocp-tools-4/jenkins-agent-base-rhel8
OpenShift Developer Tools and Services
Not affected
ocp-tools-4/jenkins-agent-base-rhel9
OpenShift Developer Tools and Services
Not affected
ocp-tools-4/jenkins-rhel8
OpenShift Developer Tools and Services
Not affected
ocp-tools-4/jenkins-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-agentic-sandbox-rhel9
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-chains-controller-rhel8
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-chains-controller-rhel9
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-cli-tkn-rhel8
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-cli-tkn-rhel9
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-opc-rhel9
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-rhel9-operator
OpenShift Serverless
Not affected
openshift-serverless-1/kn-plugin-event-sender-rhel9
OpenShift Serverless
Not affected
openshift-serverless-1/serverless-must-gather-rhel9
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/istio-must-gather-rhel9
Pen Drive Powered by Red Hat Lightspeed
Not affected
pen-drive/pen-drive-scanner-rhel9
Pen Drive Powered by Red Hat Lightspeed
Not affected
pen-drive/pen-drive-scanner-rhel9
Power monitoring for Red Hat OpenShift
Not affected
openshift-power-monitoring/power-monitoring-rhel9-operator
Red Hat Advanced Cluster Management for Kubernetes 2
Not affected
rhacm2/acm-must-gather-rhel9
Red Hat Advanced Cluster Management for Kubernetes 2
Not affected
rhacm2/submariner-rhel9-operator
Red Hat Advanced Cluster Security 4
Not affected
advanced-cluster-security/rhacs-main-rhel8
Red Hat Advanced Cluster Security 4
Not affected
advanced-cluster-security/rhacs-main-rhel9
Red Hat Advanced Cluster Security 4
Not affected
advanced-cluster-security/rhacs-operator-bundle
Red Hat Advanced Cluster Security 4
Not affected
advanced-cluster-security/rhacs-rhel8-operator
Red Hat Advanced Cluster Security 4
Not affected
advanced-cluster-security/rhacs-rhel9-operator
Red Hat Advanced Cluster Security 4
Not affected
advanced-cluster-security/rhacs-roxctl-rhel8
Red Hat Advanced Cluster Security 4
Not affected
advanced-cluster-security/rhacs-roxctl-rhel9
Red Hat Advanced Cluster Security 4
Not affected
advanced-cluster-security/rhacs-scanner-v4-rhel8
Red Hat Advanced Cluster Security 4
Not affected
advanced-cluster-security/rhacs-scanner-v4-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-25/aap-must-gather-rhel8
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/aap-must-gather-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/ee-supported-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/platform-resource-runner-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/aap-must-gather-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-tech-preview/ansible-devspaces-rhel9
Red Hat Developer Hub
Not affected
rhdh/rhdh-must-gather-rhel9
Red Hat Enterprise Linux 10
Not affected
buildah
Red Hat Enterprise Linux 10
Not affected
podman
Red Hat Enterprise Linux 10
Not affected
rhel10-eus/rhel-10.0-bootc
Red Hat Enterprise Linux 10
Not affected
skopeo
Red Hat Enterprise Linux 9
Not affected
rhel9-eus/rhel-9.6-bootc
Red Hat Hardened Images
Not affected
trivy
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-must-gather-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cpu-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cuda130-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/rhai-cli-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/cnf-tests-rhel8
Red Hat OpenShift Container Platform 4
Not affected
openshift4/cnf-tests-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/kube-compare-artifacts-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/lifecycle-agent-rhel9-operator
Red Hat OpenShift Container Platform 4
Not affected
openshift4/network-tools-rhel8
Red Hat OpenShift Container Platform 4
Not affected
openshift4/network-tools-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/numaresources-must-gather-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/oc-mirror-plugin-rhel8
Red Hat OpenShift Container Platform 4
Not affected
openshift4/oc-mirror-plugin-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-agent-installer-api-server-rhel8
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-agent-installer-csr-approver-rhel8
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-cli
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-cli-artifacts
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-cli-artifacts-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-cli-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-csi-driver-shared-resource-mustgather-rhel8
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-csi-driver-shared-resource-mustgather-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-deployer
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-deployer-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-docker-builder
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-docker-builder-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-helm-rhel9-operator
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-local-storage-mustgather-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-machine-config-operator
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-machine-config-rhel9-operator
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-machine-os-images-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-must-gather
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-must-gather-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-olm-catalogd-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-olm-operator-controller-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-openshift-controller-manager-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-secrets-store-csi-mustgather-rhel8
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-secrets-store-csi-mustgather-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-tests
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-tests-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-tools-rhel8
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-tools-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ptp-must-gather-rhel8
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ptp-must-gather-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift-kni/commatrix
Red Hat Openshift Data Foundation 4
Not affected
odf4/mcg-core-rhel9
Red Hat Openshift Data Foundation 4
Not affected
odf4/odf-cloudnative-pg-rhel9-operator
Red Hat Openshift Data Foundation 4
Not affected
odf4/odf-must-gather-rhel9
Red Hat OpenShift Dev Spaces
Not affected
devspaces/udi-rhel9
Red Hat OpenShift GitOps
Not affected
openshift-gitops-1/must-gather-rhel8
Red Hat OpenShift GitOps
Not affected
openshift-gitops-1/must-gather-rhel9
Red Hat OpenShift Virtualization 4
Not affected
container-native-virtualization/cnv-must-gather-rhel9
Red Hat OpenShift Virtualization 4
Not affected
container-native-virtualization/ocp-virt-validation-checkup-rhel9
Red Hat OpenStack Platform 18.0
Not affected
rhoso-operators/openstack-operator-bundle
Red Hat OpenStack Platform 18.0
Not affected
rhoso-operators/prometheus-podman-exporter-rhel9
Red Hat Quay 3
Not affected
quay/quay-builder-rhel9
Red Hat Trusted Artifact Signer
Affected
rekor
Red Hat Trusted Artifact Signer
Not affected
rhtas/cosign-rhel9
Red Hat Trusted Artifact Signer
Not affected
rhtas/ctlog-monitor-rhel9
Red Hat Trusted Artifact Signer
Not affected
rhtas/ec-rhel9
Red Hat Trusted Artifact Signer
Not affected
rhtas/gitsign-rhel9
Red Hat Trusted Artifact Signer
Not affected
rhtas/model-transparency-cli-rhel9
Red Hat Trusted Artifact Signer
Not affected
rhtas/model-validation-agent-rhel9
Red Hat Trusted Artifact Signer
Not affected
rhtas/model-validation-rhel9-operator
Red Hat Trusted Artifact Signer
Not affected
rhtas/policy-controller-rhel9
Red Hat Trusted Artifact Signer
Not affected
rhtas/rekor-backfill-redis-rhel9
Red Hat Trusted Artifact Signer
Not affected
rhtas/rekor-cli-rhel9
Red Hat Trusted Artifact Signer
Not affected
rhtas/rekor-monitor-rhel9
Red Hat Trusted Artifact Signer
Affected
rhtas/rekor-server-rhel9
Red Hat Trusted Artifact Signer
Not affected
rhtas/rhtas-console-rhel9
Security Profiles Operator
Not affected
compliance/openshift-security-profiles-operator-bundle
Security Profiles Operator
Not affected
compliance/openshift-security-profiles-rhel8-operator
Zero Trust Workload Identity Manager
Not affected
zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9
Zero Trust Workload Identity Manager
Not affected
zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9
Zero Trust Workload Identity Manager
Not affected
zero-trust-workload-identity-manager/spiffe-spire-server-rhel9
Zero Trust Workload Identity Manager - Tech Preview
Not affected
zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9
Zero Trust Workload Identity Manager - Tech Preview
Not affected
zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9
Zero Trust Workload Identity Manager - Tech Preview
Not affected
zero-trust-workload-identity-manager/spiffe-spire-server-rhel9
Zero Trust Workload Identity Manager - Tech Preview
Not affected
zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-operator-bundle
Zero Trust Workload Identity Manager - Tech Preview
Not affected
zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-rhel9
https://www.cve.org/CVERecord?id=CVE-2026-48702
https://nvd.nist.gov/vuln/detail/CVE-2026-48702
https://github.com/sigstore/rekor/security/advisories/GHSA-47q9-m4ww-924m