---
id: CVE-2023-30551
title: 'rekor: compressed archives can result in OOM conditions (CVE-2023-30551)'
summary: >-
  A flaw was found in Rekor. Versions prior to 1.1.1 may crash due to out of
  memory (OOM) conditions caused by reading archive metadata files into memory
  without checking their sizes first. Verification of a JAR file submitted to
  Rekor can c…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-770
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.13
affected:
  - openshift_container_platform 4
  - openshift_container_platform 4.13
  - openshift_container_platform 4.15
patched:
  - openshift_container_platform 4.13
  - openshift_container_platform 4.15
published: '2023-05-09'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T04:34:45+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-30551.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-30551.json
  - url: 'https://access.redhat.com/security/cve/CVE-2023-30551'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2196656'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2023-30551'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-30551'
  - url: >-
      https://github.com/sigstore/rekor/commit/cf42ace82667025fe128f7a50cf6b4cdff51cc48
  - url: 'https://github.com/sigstore/rekor/security/advisories/GHSA-2h5h-59f5-c5x9'
  - url: 'https://access.redhat.com/errata/RHSA-2023:7323'
  - url: 'https://access.redhat.com/errata/RHSA-2023:7198'
  - url: 'https://github.com/sigstore/rekor'
  - url: 'https://github.com/sigstore/rekor/releases/tag/v1.1.1'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - go
epss: 0.0105
epssPercentile: 0.64095
aliases:
  - GHSA-2h5h-59f5-c5x9
  - GO-2023-1754
ecosystem: go
ingestedAt: '2026-09-12T03:13:01.745Z'
---

## Overview

A flaw was found in Rekor. Versions prior to 1.1.1 may crash due to out of memory (OOM) conditions caused by reading archive metadata files into memory without checking their sizes first. Verification of a JAR file submitted to Rekor can cause an out of memory crash if files within the META-INF directory of the JAR are sufficiently large. Parsing an APK file submitted to Rekor can also cause an out of memory crash if the .SIGN or .PKGINFO files within the APK are sufficiently large. The OOM crash has been patched in Rekor version 1.1.1. There are no known workarounds.

## Vendor advisories

- **RHSA-2023:7323** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2023-11-21 · [advisory](https://access.redhat.com/errata/RHSA-2023:7323)
- **RHSA-2023:7198** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.15 · released 2024-02-27 · [advisory](https://access.redhat.com/errata/RHSA-2023:7198)
- **Red Hat VEX** · Important · affected: Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat OpenShift Container Platform 4 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-30551.json)

**rekor: compressed archives can result in OOM conditions** — rated Important by Red Hat. Released 2023-05-09, updated 2026-10-16.

Affected:

- Red Hat OpenShift Container Platform 4

Fixed:

- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform 4.15

No fix planned:

- Red Hat OpenShift Container Platform 4

Not affected:

- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform 4.15
- OpenShift API for Data Protection
- OpenShift Developer Tools and Services
- OpenShift Pipelines
- OpenShift Serverless
- Red Hat Advanced Cluster Security 3
- Red Hat Advanced Cluster Security 4
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

## Remediation

For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html
You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release a… https://access.redhat.com/errata/RHSA-2023:7323
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release … https://access.redhat.com/errata/RHSA-2023:7198

## Package advisory (CVE-2023-30551)

Affected packages:

- `github.com/sigstore/rekor < 1.1.1`

Patched in:

- `github.com/sigstore/rekor 1.1.1`

Source: https://osv.dev/vulnerability/GHSA-2h5h-59f5-c5x9