CVE-2026-23831
Medium · 5.3CVSS
5.3
EPSS
0.4%
Published
Jan 22, 2026
CISA due date
—
The record
Rekor is a software supply chain transparency log. In versions 1.4.3 and below, the entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty spec.message, causing nil Pointer Dereference. Function validate() returns nil (success) when message is empty, leaving sign1Msg uninitialized, and Canonicalize() later dereferences v.sign1Msg.Payload. A malformed proposed entry of the cose/v0.0.1 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This issue has been fixed in version 1.5.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/sigstore/rekor | 0 | 1.5.0 |
| Chainguard | aactl | 0 | 0.4.12-r42 |
| Chainguard | buildkitd | 0 | 0.27.1-r1 |
| Chainguard | buildkitd-fips | 0 | 0.27.1-r0 |
| Chainguard | cg | 0 | 0.2.200-r0 |
| Chainguard | chainctl | 0 | 0.2.197-r0 |
| Chainguard | cloudbeat-8.19 | 0 | 8.19.12-r0 |
| Chainguard | cloudbeat-9.2 | 0 | 9.2.5-r1 |
| Chainguard | cloudbeat-fips-8.19 | 0 | 8.19.12-r0 |
| Chainguard | cloudbeat-fips-9.2 | 0 | 9.2.5-r1 |
| Chainguard | cosign | 0 | 3.0.4-r2 |
| Chainguard | cosign-fips | 0 | 3.0.4-r3 |
| Chainguard | crossplane-1.20 | 0 | 1.20.4-r6 |
| Chainguard | crossplane-2.0 | 0 | 2.0.6-r4 |
| Chainguard | crossplane-2.1 | 0 | 2.1.3-r4 |
| Chainguard | crossplane-fips-1.20 | 0 | 1.20.4-r6 |
| Chainguard | crossplane-fips-2.0 | 0 | 2.0.6-r4 |
| Chainguard | crossplane-fips-2.1 | 0 | 2.1.3-r4 |
| Chainguard | falcoctl | 0 | 0.12.2-r0 |
| Chainguard | falcoctl-fips | 0 | 0.12.2-r0 |
| Chainguard | flux-source-controller | 0 | 1.7.4-r7 |
| Chainguard | flux-source-controller-fips | 0 | 1.7.4-r6 |
| Chainguard | gh | 0 | 2.86.0-r0 |
| Chainguard | gitsign | 0 | 0.14.0-r0 |
| Chainguard | goreleaser | 0 | 2.13.3-r5 |
| Chainguard | image-factory | 0 | 1.0.2-r0 |
| Chainguard | image-factory-fips | 0 | 0.9.0-r6 |
| Chainguard | ko | 0 | 0.18.1-r2 |
| Chainguard | ko-fips | 0 | 0.18.1-r2 |
| Chainguard | kubescape | 0 | 3.0.48-r0 |
| Chainguard | kyverno-1.16 | 0 | 1.16.3-r0 |
| Chainguard | kyverno-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-background-controller-1.16 | 0 | 1.16.3-r1 |
| Chainguard | kyverno-background-controller-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-background-controller-fips-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-cleanup-controller-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-cleanup-controller-fips-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-cli-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-cli-fips-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-fips-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-init-container-1.16 | 0 | 1.16.3-r1 |
| Chainguard | kyverno-init-container-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-init-container-fips-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-notation-aws | 0 | 1.1-r32 |
| Chainguard | kyverno-notation-aws-fips | 0 | 1.1-r30 |
| Chainguard | kyverno-policy-reporter-plugins-kyverno | 0 | 0.5.3-r2 |
| Chainguard | kyverno-policy-reporter-plugins-kyverno-fips | 0 | 0.5.3-r4 |
| Chainguard | kyverno-reports-controller-1.16 | 0 | 1.16.3-r1 |
| Chainguard | kyverno-reports-controller-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-reports-controller-fips-1.16 | 0 | 1.16.3-r2 |
| Chainguard | neuvector-sigstore-interface | 0 | 0_git20251212-r3 |
| Chainguard | neuvector-sigstore-interface-fips | 0 | 0_git20260130-r0 |
| Chainguard | policy-controller | 0 | 0.15.1-r0 |
| Chainguard | policy-controller-fips | 0 | 0.15.1-r0 |
| Chainguard | policy-controller-tester | 0 | 0.15.1-r0 |
| Chainguard | policy-controller-tester-fips | 0 | 0.15.1-r0 |
| Chainguard | ratify | 0 | 1.4.0-r10 |
| Chainguard | ratify-fips | 0 | 1.4.0-r11 |
| Chainguard | skaffold | 0 | 2.17.1-r4 |
| Chainguard | skaffold-fips | 0 | 2.17.1-r2 |
| Chainguard | slsa-verifier | 0 | 2.7.1-r8 |
| Chainguard | spire-agent | 0 | 1.14.1-r2 |
| Chainguard | spire-agent-fips | 0 | 1.14.1-r2 |
| Chainguard | tekton-chains | 0 | 0.26.0-r6 |
| Chainguard | tekton-chains-fips | 0 | 0.26.0-r5 |
| Chainguard | teleport-18.6 | 0 | 18.6.8-r9 |
| Chainguard | teleport-18.6-kube-agent-updater | 0 | 18.6.8-r9 |
| Chainguard | tflint | 0 | 0.60.0-r7 |
| Chainguard | tflint-fips | 0 | 0.60.0-r5 |
| Chainguard | tkn | 0 | 0.43.0-r4 |
| Chainguard | tkn-fips | 0 | 0.43.0-r4 |
| Chainguard | trivy | 0 | 0.68.2-r2 |
| Chainguard | trivy-fips | 0 | 0.68.2-r2 |
| Chainguard | trivy-operator | 0 | 0.29.0-r7 |
| Chainguard | trivy-operator-fips | 0 | 0.29.0-r8 |
| Chainguard | vexctl | 0 | 0.4.1-r8 |
| Chainguard | witness | 0 | 0.10.2-r4 |
| Chainguard | zarf | 0 | 0.70.1-r3 |
| Chainguard | zot | 0 | 2.1.14-r0 |
| Wolfi | aactl | 0 | 0.4.12-r42 |
| Wolfi | buildkitd | 0 | 0.27.1-r1 |
| Wolfi | cosign | 0 | 3.0.4-r2 |
| Wolfi | cosign-fips | 0 | 3.0.4-r3 |
| Wolfi | crossplane-2.1 | 0 | 2.1.3-r4 |
| Wolfi | falcoctl | 0 | 0.12.2-r0 |
| Wolfi | flux-source-controller | 0 | 1.7.4-r7 |
| Wolfi | gh | 0 | 2.86.0-r0 |
| Wolfi | gitsign | 0 | 0.14.0-r0 |
| Wolfi | goreleaser | 0 | 2.13.3-r5 |
| Wolfi | ko | 0 | 0.18.1-r2 |
| Wolfi | ko-fips | 0 | 0.18.1-r2 |
| Wolfi | kubescape | 0 | 3.0.48-r0 |
| Wolfi | kyverno-1.16 | 0 | 1.16.3-r0 |
| Wolfi | kyverno-1.16 | 0 | 1.16.3-r2 |
| Wolfi | kyverno-background-controller-1.16 | 0 | 1.16.3-r1 |
| Wolfi | kyverno-background-controller-1.16 | 0 | 1.16.3-r2 |
| Wolfi | kyverno-cleanup-controller-1.16 | 0 | 1.16.3-r2 |
| Wolfi | kyverno-cli-1.16 | 0 | 1.16.3-r2 |
| Wolfi | kyverno-init-container-1.16 | 0 | 1.16.3-r1 |
| Wolfi | kyverno-init-container-1.16 | 0 | 1.16.3-r2 |
| Wolfi | kyverno-notation-aws | 0 | 1.1-r32 |
| Wolfi | kyverno-reports-controller-1.16 | 0 | 1.16.3-r1 |
| Wolfi | kyverno-reports-controller-1.16 | 0 | 1.16.3-r2 |
| Wolfi | neuvector-sigstore-interface | 0 | 0_git20251212-r3 |
| Wolfi | policy-controller | 0 | 0.15.1-r0 |
| Wolfi | policy-controller-tester | 0 | 0.15.1-r0 |
| Wolfi | ratify | 0 | 1.4.0-r10 |
| Wolfi | skaffold | 0 | 2.17.1-r4 |
| Wolfi | slsa-verifier | 0 | 2.7.1-r8 |
| Wolfi | spire-agent | 0 | 1.14.1-r2 |
| Wolfi | tekton-chains | 0 | 0.26.0-r6 |
| Wolfi | teleport-18.6 | 0 | 18.6.8-r9 |
| Wolfi | teleport-18.6-kube-agent-updater | 0 | 18.6.8-r9 |
| Wolfi | tflint | 0 | 0.60.0-r7 |
| Wolfi | tkn | 0 | 0.43.0-r4 |
| Wolfi | trivy | 0 | 0.68.2-r2 |
| Wolfi | trivy-operator | 0 | 0.29.0-r7 |
| Wolfi | vexctl | 0 | 0.4.1-r8 |
| Wolfi | witness | 0 | 0.10.2-r4 |
| Wolfi | zarf | 0 | 0.70.1-r3 |
| Wolfi | zot | 0 | 2.1.14-r0 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260205T172317-150000.1.146.1 |
| openSUSE:Tumbleweed | rekor | 0 | 1.5.0-1.1 |
Related vulnerabilities
- CVE-2026-24117 Rekor is a software supply chain transparency log. Also affects github.com/sigstore/rekor
- CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Also affects aactl
- CVE-2025-15558 Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins… Also affects aactl
- CVE-2026-1229 The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an… Also affects aactl
- CVE-2026-26958 filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with… Also affects aactl
- CVE-2025-68121 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or… Also affects aactl
- CVE-2025-61732 A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling… Also affects aactl
- CVE-2025-68119 Downloading and building modules with malicious version strings can cause local code… Also affects aactl