GHSA-273p-m2cw-6833

    Dashboard / Vulnerabilities / GHSA-273p-m2cw-6833

    GHSA-273p-m2cw-6833

    Published: 22 Jan 2026Last Modified: 10 Sept 2026

    Summary: Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty Message

    Details: ## Summary Rekor’s cose v0.0.1 entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty `spec.message`. `validate()` returns nil (success) when `message` is empty, leaving `sign1Msg` uninitialized, and `Canonicalize()` later dereferences `v.sign1Msg.Payload`. ## Impact A malformed proposed entry of the `cose/v0.0.1` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. ## Patches Upgrade to v1.5.0 ## Workarounds None

    References: https://github.com/sigstore/rekor/security/advisories/GHSA-273p-m2cw-6833, https://nvd.nist.gov/vuln/detail/CVE-2026-23831, https://github.com/sigstore/rekor/commit/39bae3d192bce48ef4ef2cbd1788fb5770fee8cd, https://github.com/sigstore/rekor, https://github.com/sigstore/rekor/releases/tag/v1.5.0

    Affected packages

    Package

    Name: github.com/sigstore/rekor

    Purl: pkg:golang/github.com/sigstore/rekor

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -1.5.0

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-273p-m2cw-6833 | CVE-DB