CVE-2023-30551

Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions caused by reading archive metadata files into memory without checking their sizes first. Verification of a JAR file submitted to Rekor can cause an out of memory crash if files within the META-INF directory of the JAR are sufficiently large. Parsing of an APK file submitted to Rekor can cause an out of memory crash if the .SIGN or .PKGINFO files within the APK are sufficiently large. The OOM crash has been patched in Rekor version 1.1.1. There are no known workarounds.

• CWE-770

• https://github.com/sigstore/rekor/commit/cf42ace82667025fe128f7a50cf6b4cdff51cc48Patch
• https://github.com/sigstore/rekor/releases/tag/v1.1.1Release Notes
• https://github.com/sigstore/rekor/security/advisories/GHSA-2h5h-59f5-c5x9Vendor Advisory
• https://github.com/sigstore/rekor/commit/cf42ace82667025fe128f7a50cf6b4cdff51cc48Patch
• https://github.com/sigstore/rekor/releases/tag/v1.1.1Release Notes
• https://github.com/sigstore/rekor/security/advisories/GHSA-2h5h-59f5-c5x9Vendor Advisory

Published

May 8, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-30546Contiki-NG is an operating system for Internet of Things dev…7.5
• CVE-2023-30547vm2 is a sandbox that can run untrusted code with whiteliste…10
• CVE-2023-30548gatsby-plugin-sharp is a plugin for the gatsby framework whi…4.3
• CVE-2023-30549Apptainer is an open source container platform for Linux. Th…7.8
• CVE-2023-3055The Page Builder by AZEXO plugin for WordPress is vulnerable…4.3
• CVE-2023-30550MeterSphere is an open source continuous testing platform, c…4.5
• CVE-2023-30552Archery is an open source SQL audit platform. The Archery pr…6.5
• CVE-2023-30553Archery is an open source SQL audit platform. The Archery pr…6.5
• CVE-2023-30554Archery is an open source SQL audit platform. The Archery pr…6.5
• CVE-2023-30555Archery is an open source SQL audit platform. The Archery pr…6.5
• CVE-2023-30556Archery is an open source SQL audit platform. The Archery pr…6.5
• CVE-2023-30557Archery is an open source SQL audit platform. The Archery pr…6.5