github.com/sigstore/rekor (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package github.com/sigstore/rekor, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (4)

• CVE-2023-30551 — CVSS 7.5 (high): Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM)…
• CVE-2023-33199 — CVSS 5.3 (medium): Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A…
• CVE-2026-23831 — CVSS 5.3 (medium): Rekor is a software supply chain transparency log. In versions 1.4.3 and below, the entry implementation can panic on attacker-controlled…
• CVE-2026-24117 — CVSS 5.3 (medium): Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services…