{"id":"CVE-2023-30551","title":"rekor: compressed archives can result in OOM conditions (CVE-2023-30551)","summary":"A flaw was found in Rekor. Versions prior to 1.1.1 may crash due to out of memory (OOM) conditions caused by reading archive metadata files into memory without checking their sizes first. Verification of a JAR file submitted to Rekor can c…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-770","vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.13","affected":["openshift_container_platform 4","openshift_container_platform 4.13","openshift_container_platform 4.15"],"patched":["openshift_container_platform 4.13","openshift_container_platform 4.15"],"published":"2023-05-09","updated":"2026-10-16","sourceUpdated":"2026-10-16T04:34:45+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-30551.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-30551.json"},{"url":"https://access.redhat.com/security/cve/CVE-2023-30551"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2196656"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-30551"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30551"},{"url":"https://github.com/sigstore/rekor/commit/cf42ace82667025fe128f7a50cf6b4cdff51cc48"},{"url":"https://github.com/sigstore/rekor/security/advisories/GHSA-2h5h-59f5-c5x9"},{"url":"https://access.redhat.com/errata/RHSA-2023:7323"},{"url":"https://access.redhat.com/errata/RHSA-2023:7198"},{"url":"https://github.com/sigstore/rekor"},{"url":"https://github.com/sigstore/rekor/releases/tag/v1.1.1"}],"tags":["csaf","vex","red-hat","osv","go"],"epss":0.0105,"epssPercentile":0.64095,"aliases":["GHSA-2h5h-59f5-c5x9","GO-2023-1754"],"ecosystem":"go","ingestedAt":"2026-09-12T03:13:01.745Z","slug":"CVE-2023-30551","body":"## Overview\n\nA flaw was found in Rekor. Versions prior to 1.1.1 may crash due to out of memory (OOM) conditions caused by reading archive metadata files into memory without checking their sizes first. Verification of a JAR file submitted to Rekor can cause an out of memory crash if files within the META-INF directory of the JAR are sufficiently large. Parsing an APK file submitted to Rekor can also cause an out of memory crash if the .SIGN or .PKGINFO files within the APK are sufficiently large. The OOM crash has been patched in Rekor version 1.1.1. There are no known workarounds.\n\n## Vendor advisories\n\n- **RHSA-2023:7323** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2023-11-21 · [advisory](https://access.redhat.com/errata/RHSA-2023:7323)\n- **RHSA-2023:7198** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.15 · released 2024-02-27 · [advisory](https://access.redhat.com/errata/RHSA-2023:7198)\n- **Red Hat VEX** · Important · affected: Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat OpenShift Container Platform 4 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-30551.json)\n\n**rekor: compressed archives can result in OOM conditions** — rated Important by Red Hat. Released 2023-05-09, updated 2026-10-16.\n\nAffected:\n\n- Red Hat OpenShift Container Platform 4\n\nFixed:\n\n- Red Hat OpenShift Container Platform 4.13\n- Red Hat OpenShift Container Platform 4.15\n\nNo fix planned:\n\n- Red Hat OpenShift Container Platform 4\n\nNot affected:\n\n- Red Hat OpenShift Container Platform 4.13\n- Red Hat OpenShift Container Platform 4.15\n- OpenShift API for Data Protection\n- OpenShift Developer Tools and Services\n- OpenShift Pipelines\n- OpenShift Serverless\n- Red Hat Advanced Cluster Security 3\n- Red Hat Advanced Cluster Security 4\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n\n## Remediation\n\nFor OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\n      https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n      The sha values for the release a… https://access.redhat.com/errata/RHSA-2023:7323\nFor OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\n      https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n      The sha values for the release … https://access.redhat.com/errata/RHSA-2023:7198\n\n## Package advisory (CVE-2023-30551)\n\nAffected packages:\n\n- `github.com/sigstore/rekor < 1.1.1`\n\nPatched in:\n\n- `github.com/sigstore/rekor 1.1.1`\n\nSource: https://osv.dev/vulnerability/GHSA-2h5h-59f5-c5x9","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}