CVE-2023-30551

    Dashboard / Vulnerabilities / CVE-2023-30551

    CVE-2023-30551

    Published: 8 May 2023Last Modified: 12 Aug 2026

    Summary: Rekor's compressed archives can result in OOM conditions

    Details: Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions caused by reading archive metadata files into memory without checking their sizes first. Verification of a JAR file submitted to Rekor can cause an out of memory crash if files within the META-INF directory of the JAR are sufficiently large. Parsing of an APK file submitted to Rekor can cause an out of memory crash if the .SIGN or .PKGINFO files within the APK are sufficiently large. The OOM crash has been patched in Rekor version 1.1.1. There are no known workarounds.

    References: https://github.com/sigstore/rekor/releases/tag/v1.1.1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30551.json, https://github.com/sigstore/rekor/security/advisories/GHSA-2h5h-59f5-c5x9, https://nvd.nist.gov/vuln/detail/CVE-2023-30551, https://github.com/sigstore/rekor/commit/cf42ace82667025fe128f7a50cf6b4cdff51cc48

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -0c1914e5e955cb9f514e32b222cf61a13e91ab08

    Affected versions

    v1.1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-30551 | CVE-DB