5.3

CVE-2026-23831: linuxfoundation rekor NULL Pointer Dereference

CVSS: 5.3v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2026-23831DEBIAN-CVE-2026-23831CGA-2j2r-vp2g-hmqh
Published 22-01-2026Last modified 23-01-2026
Open JSON

Vulnerability summary

CVE-2026-23831 is a medium (CVSS 5.3) NULL Pointer Dereference vulnerability in linuxfoundation rekor. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.4% of scored vulnerabilities.

Overall risk
21/100
0100
Low · default modelHow is this calculated?
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.43%
0%100%
Low · -0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 4
OPENSUSE-SU-2026:10127-1OPENSUSE-SU-2026:21483-1SUSE-SU-2026:0403-1CGA-28F7-F37X-XFXJ

Timeline

  1. 22-01-2026
    PublishedVulnerability first disclosed.
  2. 23-01-2026
    Last modifiedVulnerability information updated.

Description

Rekor is a software supply chain transparency log. In versions 1.4.3 and below, the entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty spec.message, causing nil Pointer Dereference. Function validate() returns nil (success) when message is empty, leaving sign1Msg uninitialized, and Canonicalize() later dereferences v.sign1Msg.Payload. A malformed proposed entry of the cose/v0.0.1 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This issue has been fixed in version 1.5.0.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.43%

Chance of exploitation in the next 30 days

Percentile

35%

Versus all other CVEs

30-day change

-0.01 pp

From 0.44% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.43%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard133 products
  • aactl< 0.4.12-r42
  • buildkitd< 0.27.1-r1
  • buildkitd-fips< 0.27.1-r0
  • cg< 0.2.200-r0
  • chainctl< 0.2.197-r0
Wolfi36 products
  • aactl< 0.4.12-r42
  • buildkitd< 0.27.1-r1
  • cosign< 3.0.4-r2
  • crossplane-2.1< 2.1.3-r4
  • falcoctl< 0.12.2-r0
Debian1 product
  • rekorAll versions (No fix recorded) | < 1.5.0-1
Github.com/sigstore1 product
  • rekor< 1.5.0
Linuxfoundation1 product
Sigstore1 product
Ubuntu1 product
  • rekorAll versions (No fix recorded)

7 vendors · 174 products

References

9 links