Bug 2499685 (CVE-2026-48702)

Summary: CVE-2026-48702 github.com/sigstore/rekor: Rekor: Denial of Service due to unbounded gzip decompression in Alpine APK parsing
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: abarbaro, agarcial, akoudelk, alizardo, anjoseph, anpicker, aoconnor, aruklets, asegurap, cahl, derez, dfreiber, dhanak, dkeler, doconnor, drosa, drow, dschmidt, dsimansk, dymurray, eborisov, ebourniv, eglynn, gparvin, hasun, ibolton, jburrell, jcantril, jchui, jfula, jhe, jjoyce, jlanda, jmatthew, jmontleo, jowilson, jprabhak, jpretori, jsamir, jschluet, kbempah, kingland, kshier, ktsao, lball, lbragsta, lgallett, lgamliel, lhh, ljawale, manissin, mburns, mgarciac, mnovotny, msilmser, nboldt, ngough, nyancey, oaljalju, ometelka, pakotvan, pgaikwad, psrna, ptisnovs, rekumar, rhaigner, rhel-process-autobot, rjohnson, rojacob, sakbas, sausingh, sbratsla, sbunciak, sdawley, simaishi, slucidi, solenoci, sseago, stcannon, sthirugn, suppawar, syedriko, teagle, thason, veshanka, vkumar, vvoronko, watson-tool-maintainers, wenshen, whayutin, wtam, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Rekor. The `Package.Unmarshal()` function, which processes Alpine Package Keep (APK) files, decompresses gzip streams without limiting the total decompressed size. A remote attacker can exploit this by crafting a malicious APK file with a high compression ratio, causing the server to consume excessive memory. This leads to a Denial of Service (DoS) through an out-of-memory (OOM) error, and can be triggered via unauthenticated API endpoints.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-13 14:39:55 UTC 
Rekor's Package.Unmarshal() function in pkg/types/alpine/apk.go decompresses signature and control gzip members of APK files into in-memory buffers without bounding the total decompressed size. An attacker can craft a gzip stream with ~1000:1 compression ratio, causing the server to consume unbounded heap memory and trigger OOM-kill. Reachable via unauthenticated POST /api/v1/log/entries and POST /api/v1/log/entries/retrieve. Fixed in rekor 1.5.2.