5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23831

CVE-2026-23831: Rekor COSE v0.0.1 Canonicalize crashes when passed empty Message

Rekor is a software supply chain transparency log. In versions 1.4.3 and below, the entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty spec.message, causing nil Pointer Dereference. Function validate() returns nil (success) when message is empty, leaving sign1Msg uninitialized, and Canonicalize() later dereferences v.sign1Msg.Payload. A malformed proposed entry of the cose/v0.0.1 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This issue has been fixed in version 1.5.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23831

CVE-2026-23831:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/sigstore/rekor	go	<= 1.4.3	1.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a nil pointer dereference in Rekor when processing cose/v0.0.1 entries, caused by insufficient validation of user-provided data. An entry with an empty message field could pass initial validation, leaving the sign1Msg field of the internal V001Entry struct as nil. The subsequent call to the Canonicalize method on this struct would then attempt to access v.sign1Msg.Payload, triggering a panic. The patch addresses this by adding explicit nil checks for v.sign1Msg and v.sign1Msg.Payload within the V001Entry.Canonicalize function in pkg/types/cose/v0.0.1/entry.go. The same commit also fixes a similar nil pointer dereference vulnerability in the Canonicalize method for dsse/v0.0.1 entries, where a signature object within a list of signatures could be nil. Additionally, the Unmarshal methods for both cose and dsse entry types were hardened to reject malformed entries earlier. Therefore, the primary vulnerable functions that would appear in a runtime profile during exploitation are the Canonicalize methods for both cose and dsse v0.0.1 entry types.

Vulnerable functions

V001Entry.Canonicalize

pkg/types/cose/v0.0.1/entry.go

The function was vulnerable to a nil pointer dereference. If an entry was created with an empty `spec.message`, the `sign1Msg` field of the `V001Entry` struct would not be initialized. When `Canonicalize` was called on this entry, it would attempt to access `v.sign1Msg.Payload`, causing a panic. The patch adds checks to ensure `v.sign1Msg` and `v.sign1Msg.Payload` are not nil before they are accessed.

V001Entry.Canonicalize

pkg/types/dsse/v0.0.1/entry.go

The function iterates through a slice of signatures (`canonicalEntry.Signatures`). If an item `s` in this slice is `nil`, the original code would panic when trying to access `s.Signature`. The patch adds a check for `s == nil` to prevent this nil pointer dereference. While not the primary vulnerability reported, it was fixed in the same patch and represents a similar flaw.

V001Entry.Unmarshal

pkg/types/cose/v0.0.1/entry.go

This function is responsible for unmarshalling the proposed entry. The patch adds a check to ensure a public key is present. While not the direct cause of the panic, a missing public key is an invalid state that could lead to subsequent errors. This function is on the execution path to the vulnerable `Canonicalize` function.

V001Entry.Unmarshal

pkg/types/dsse/v0.0.1/entry.go

This function unmarshals the DSSE entry. The patch adds a check to ensure the envelope is not missing. This prevents processing of a malformed entry that could cause issues later in the `Canonicalize` function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.