CVE catalog
CVE-2026-23831
DEBIAN-CVE-2026-23831
- Severity
- Medium · CVSS 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.43% · Oct 27, 2026
Rekor is a software supply chain transparency log. In versions 1.4.3 and below, the entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty spec.message, causing nil Pointer Dereference. Function validate() returns nil (success) when message is empty, leaving sign1Msg uninitialized, and Canonicalize() later dereferences v.sign1Msg.Payload. A malformed proposed entry of the cose/v0.0.1 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This issue has been fixed in version 1.5.0.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | rekor | 13 | 1.3.10-1 | vulnerable |
| Debian | rekor | 13 | 1.3.9-1 | vulnerable |
| Debian | rekor | 13 | 1.4.0-1 | vulnerable |
| Debian | rekor | 13 | 1.4.2-1 | vulnerable |
| Debian | rekor | 13 | 1.4.3-1 | vulnerable |
| Debian | rekor | 13 | 1.5.0-1 | vulnerable |
| Debian | rekor | 13 | 1.5.1-1 | vulnerable |
| Debian | rekor | 13 | 1.5.2-1 | vulnerable |
| Debian | rekor | 13 | 1.5.3-1 | vulnerable |
| Debian | rekor | 13 | 1.5.3-2 | vulnerable |
| Debian | rekor | 14 | 1.3.10-1 | vulnerable |
| Debian | rekor | 14 | 1.3.9-1 | vulnerable |
| Debian | rekor | 14 | 1.4.0-1 | vulnerable |
| Debian | rekor | 14 | 1.4.2-1 | vulnerable |
| Debian | rekor | 14 | 1.4.3-1 | vulnerable |
| Debian | rekor | 14 | 1.5.0-1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | rekor | deb | 14 | 1.5.0-1 | Not reported | DEBIAN-CVE-2026-23831 | Not reported |
OpenFactory catalog packages
[Debian 13 (Trixie)]
- [golang-github-sigstore-rekor-dev]Affected
Source package: [rekor]
Details (2)
1.3.9-1· all · trixieAffected
pypi · rekor · debian · 13
1.3.9-1· all · trixieAffected
pypi · rekor · debian · 13
- [rekor]Affected
Source package: [rekor]
Details (2)
1.3.9-1+b5· amd64 · trixieAffected
pypi · rekor · debian · 13
1.3.9-1+b5· arm64 · trixieAffected
pypi · rekor · debian · 13
Observed:
References
- [https://access.redhat.com/errata/RHSA-2026:37387]
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10127-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-23831]
[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]