CVE-2023-30551
Rekor's compressed archives can result in OOM conditions
Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions caused by reading archive metadata files into memory without checking their sizes first. Verification of a JAR file submitted to Rekor can cause an out of memory crash if files within the META-INF directory of the JAR are sufficiently large. Parsing of an APK file submitted to Rekor can cause an out of memory crash if the .SIGN or .PKGINFO files within the APK are sufficiently large. The OOM crash has been patched in Rekor version 1.1.1. There are no known workarounds.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Rekor's compressed archives can result in OOM conditions
Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions caused by reading archive metadata files into memory without checking their sizes first. Verification of a JAR file submitted to Rekor can cause an out of memory crash if files within the META-INF directory of the JAR are sufficiently large. Parsing of an APK file submitted to Rekor can cause an out of memory crash if the .SIGN or .PKGINFO files within the APK are sufficiently large. The OOM crash has been patched in Rekor version 1.1.1. There are no known workarounds.
- Record
CVE-2023-30551- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2023-1450
Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions caused by reading archive metadata files into memory without checking their sizes first. Verification of a JAR file submitted to Rekor can cause an out of memory crash if files within the META-INF directory of the JAR are sufficiently large. Parsing of an APK file submitted to Rekor can cause an out of memory crash if the .SIGN or .PKGINFO files within the APK are sufficiently large. The OOM crash has been patched in Rekor version 1.1.1. There are no known workarounds.
- Record
EUVD-2023-1450- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2h5h-59f5-c5x9
Rekor's compressed archives can result in OOM conditions
Summary
Two vulnerabilities have been found in Rekor types for archive files JARs and APKs, where Rekor would crash due to out of memory conditions caused by reading archive metadata files into memory without checking their sizes first causing a Denial of Service of Rekor.
These vulnerabilities were found through fuzzing with OSS-Fuzz.
Vulnerability 1: OOM due to large files in META-INF directory of JAR files.
Summary
Verification of a JAR file submitted to Rekor can cause an out of memory crash if files within the META-INF directory of the JAR are sufficiently large.
Details
As part of verifying a JAR file, Rekor uses the relic library to check that the JAR is signed, the signature verifies, and that the hashes in the signed manifest are all valid. This library function reads files within META-INF/ into memory without checking their sizes, resulting in an OOM if the uncompressed file is sufficiently large. Rekor is also not performing any such checks prior to passing the JAR to this library function.
Patches
Users should update to the latest version of Rekor, 1.1.1.
Workaround
There are no workarounds, users should update.
Vulnerability 2: OOM due to large .SIGN and .PKGINFO files in APK files.
Summary
Parsing of an APK file submitted to Rekor can cause an out of memory crash if the .SIGN or .PKGINFO files within the APK are sufficiently large.
Details
When parsing an APK file, Rekor allocates byte slices to read both the .SIGN and .PKGINFO files into memory in order to verify the signature and hashes in the APK. These byte slices are allocated based on the size included in the tar header for each file, with no checks performed on that size. If the size in the header is sufficiently large, either because the uncompressed file is large or the size in the header has been artificially set to a large value, Rekor will crash due to an out of memory panic.
Patches
Users should update to the latest version of Rekor, 1.1.1.
Workaround
There are no workarounds, users should update.
- Record
GHSA-2h5h-59f5-c5x9- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions caused by reading archive metadata files into memory without checking their sizes first. Verification of a JAR file submitted to Rekor can cause an out of memory crash if files within the META-INF directory of the JAR are sufficiently large. Parsing of an APK file submitted to Rekor can cause an out of memory crash if the .SIGN or .PKGINFO files within the APK are sufficiently large. The OOM crash has been patched in Rekor version 1.1.1. There are no known workarounds.
- Record
CVE-2023-30551- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVALPINE-CVE-2023-30551
Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions caused by reading archive metadata files into memory without checking their sizes first. Verification of a JAR file submitted to Rekor can cause an out of memory crash if files within the META-INF directory of the JAR are sufficiently large. Parsing of an APK file submitted to Rekor can cause an out of memory crash if the .SIGN or .PKGINFO files within the APK are sufficiently large. The OOM crash has been patched in Rekor version 1.1.1. There are no known workarounds.
- Record
ALPINE-CVE-2023-30551- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
Rekor's compressed archives can result in OOM conditions
Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions caused by reading archive metadata files into memory without checking their sizes first. Verification of a JAR file submitted to Rekor can cause an out of memory crash if files within the META-INF directory of the JAR are sufficiently large. Parsing of an APK file submitted to Rekor can cause an out of memory crash if the .SIGN or .PKGINFO files within the APK are sufficiently large. The OOM crash has been patched in Rekor version 1.1.1. There are no known workarounds.
- Record
CVE-2023-30551- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-2h5h-59f5-c5x9
Rekor's compressed archives can result in OOM conditions
Summary
Two vulnerabilities have been found in Rekor types for archive files JARs and APKs, where Rekor would crash due to out of memory conditions caused by reading archive metadata files into memory without checking their sizes first causing a Denial of Service of Rekor.
These vulnerabilities were found through fuzzing with OSS-Fuzz.
Vulnerability 1: OOM due to large files in META-INF directory of JAR files.
Summary
Verification of a JAR file submitted to Rekor can cause an out of memory crash if files within the META-INF directory of the JAR are sufficiently large.
Details
As part of verifying a JAR file, Rekor uses the relic library to check that the JAR is signed, the signature verifies, and that the hashes in the signed manifest are all valid. This library function reads files within META-INF/ into memory without checking their sizes, resulting in an OOM if the uncompressed file is sufficiently large. Rekor is also not performing any such checks prior to passing the JAR to this library function.
Patches
Users should update to the latest version of Rekor, 1.1.1.
Workaround
There are no workarounds, users should update.
Vulnerability 2: OOM due to large .SIGN and .PKGINFO files in APK files.
Summary
Parsing of an APK file submitted to Rekor can cause an out of memory crash if the .SIGN or .PKGINFO files within the APK are sufficiently large.
Details
When parsing an APK file, Rekor allocates byte slices to read both the .SIGN and .PKGINFO files into memory in order to verify the signature and hashes in the APK. These byte slices are allocated based on the size included in the tar header for each file, with no checks performed on that size. If the size in the header is sufficiently large, either because the uncompressed file is large or the size in the header has been artificially set to a large value, Rekor will crash due to an out of memory panic.
Patches
Users should update to the latest version of Rekor, 1.1.1.
Workaround
There are no workarounds, users should update.
- Record
GHSA-2h5h-59f5-c5x9- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGO-2023-1754 No score
Rekor's compressed archives can result in OOM conditions in github.com/sigstore/rekor
Rekor's compressed archives can result in OOM conditions in github.com/sigstore/rekor
- Record
GO-2023-1754- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12919-1 No score
rekor-1.1.1-2.1 on GA media
These are all security issues fixed in the rekor-1.1.1-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12919-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2210-1 No score
Security update for rekor
This update for rekor fixes the following issues:
Updated to version 1.1.1 (jsc#SLE-23476):
Functional Enhancements
-
Refactor Trillian client with exported methods (#1454)
-
Switch to official redis-go client (#1459)
-
Remove replace in go.mod (#1444)
-
Add Rekor OID info. (#1390) Quality Enhancements
-
remove legacy encrypted cosign key (#1446)
-
swap cjson dependency (#1441)
-
Update release readme (#1456) Security fixes:
-
CVE-2023-30551: Fixed a potential denial of service when processing JAR META-INF files or .SIGN/.PKINFO files in APK files (bsc#1211210).
-
updated to rekor 1.1.0 (jsc#SLE-23476): Functional Enhancements
- improve validation on intoto v0.0.2 type (#1351)
- add feature to limit HTTP request body length to process (#1334)
- add information about the file size limit (#1313)
- Add script to backfill Redis from Rekor (#1163)
- Feature: add search support for sha512 (#1142) Quality Enhancements
- various fuzzing fixes Bug Fixes
- remove goroutine usage from SearchLogQuery (#1407)
- drop log messages regarding attestation storage to debug (#1408)
- fix validation for proposed vs committed log entries for intoto v0.0.1 (#1309)
- fix: fix regex for multi-digit counts (#1321)
- return NotFound if treesize is 0 rather than calling trillian (#1311)
- enumerate slice to get sugared logs (#1312)
- put a reasonable size limit on ssh key reader (#1288)
- CLIENT: Fix Custom Host and Path Issue (#1306)
- do not persist local state if log is empty; fail consistency proofs from 0 size (#1290)
- correctly handle invalid or missing pki format (#1281)
- Add Verifier to get public key/cert and identities for entry type (#1210)
- fix goroutine leak in client; add insecure TLS option (#1238)
- Fix - Remove the force-recreate flag (#1179)
- trim whitespace around public keys before parsing (#1175)
- stop inserting envelope hash for intoto:0.0.2 types into index (#1171)
- Revert 'remove double encoding of payload and signature fields for intoto (#1150)' (#1158)
- remove double encoding of payload and signature fields for intoto (#1150)
- fix SearchLogQuery behavior to conform to openapi spec (#1145)
- Remove pem-certificate-chain from client (#1138)
- fix flag type for operator in search (#1136)
- use sigstore/community dep review (#1132)
- Record
SUSE-SU-2023:2210-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/sigstore/rekorGo |
before 1.1.1 | 1.1.1 |
rekorAlpine:v3.18 |
before 1.1.1-r0 | 1.1.1-r0 |
rekorAlpine:v3.19 |
before 1.1.1-r0 | 1.1.1-r0 |
rekorAlpine:v3.20 |
before 1.1.1-r0 | 1.1.1-r0 |
rekorAlpine:v3.21 |
before 1.1.1-r0 | 1.1.1-r0 |
rekorAlpine:v3.22 |
before 1.1.1-r0 | 1.1.1-r0 |
rekorAlpine:v3.23 |
before 1.1.1-r0 | 1.1.1-r0 |
rekorAlpine:v3.24 |
before 1.1.1-r0 | 1.1.1-r0 |
rekorSUSE:Linux Enterprise Module for Basesystem 15 SP4 |
before 1.1.1-150400.4.9.1 | 1.1.1-150400.4.9.1 |
rekoropenSUSE:Leap 15.4 |
before 1.1.1-150400.4.9.1 | 1.1.1-150400.4.9.1 |
rekoropenSUSE:Tumbleweed |
before 1.1.1-2.1 | 1.1.1-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-30551 is a high vulnerability (CVSS 7.5) in Linuxfoundation Rekor, published May 3, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.05%, the 64th percentile. Fixed in github.com/sigstore/rekor 1.1.1.
References
github.com/sigstore/rekor/security/advisories/GHSA-2h5h-59f5-c5x9
nvd.nist.gov/vuln/detail/CVE-2023-30551
security.alpinelinux.org/vuln/CVE-2023-30551