High severity · published May 8, 2023
CVE-2023-30551
Rekor is an open source software supply chain transparency log
7.5
CVSS
1%
EPSS
No
On KEV
Description
Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions caused by reading archive metadata files into memory without checking their sizes first. Verification of a JAR file submitted to Rekor can cause an out of memory crash if files within the META-INF directory of the JAR are sufficiently large. Parsing of an APK file submitted to Rekor can cause an out of memory crash if the .SIGN or .PKGINFO files within the APK are sufficiently large. The OOM crash has been patched in Rekor version 1.1.1. There are no known workarounds.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
Rekor · Linuxfoundation
before 1.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-30551
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-30551
Patch
https://github.com/sigstore/rekor/commit/cf42ace82667025fe128f7a50cf6b4cdff51cc48
Release Notes
https://github.com/sigstore/rekor/releases/tag/v1.1.1
Vendor Advisory
https://github.com/sigstore/rekor/security/advisories/GHSA-2h5h-59f5-c5x9
More from Rekor
5.3
CVE-2026-24117
Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL
5.3
CVE-2026-23831
Rekor COSE v0.0.1 Canonicalize crashes when passed empty Message
5.3
CVE-2023-33199
Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain