Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size. The existing `max_apk_metadata_size` check (default 1MB) is only applied to individual tar entry header sizes after decompression completes, so it does not prevent a decompression bomb from consuming unbounded heap memory. An attacker can craft a gzip stream that compresses at a ~1000:1 ratio (e.g., 2MB compressed zeros → 2GB decompressed). When submitted as spec.package.content in an Alpine `ProposedEntry`, the server decompresses the full payload into memory during request processing, triggering a fatal Go runtime out-of-memory error or OS OOM-kill that cannot be caught by the server's recover() middleware. This is reachable via two unauthenticated endpoints, `POST /api/v1/log/entries (createLogEntry)` and `POST /api/v1/log/entries/retrieve (searchLogQuery)`. Both invoke `V001Entry.Canonicalize()` → `fetchExternalEntities()` → `apk.Unmarshal(packageData)`, which performs the unbounded decompression. Version 1.5.2 patches the issue. There is no effective workaround. Setting `max_request_body_size` reduces but does not eliminate exposure due to the ~1000:1 compression ratio (a 1MB body limit still allows ~1GB heap allocation). Setting `max_apk_metadata_size` has no effect on this vulnerability since the check is applied after decompression.

The version of runfinch-finch installed on the remote host is prior to 1.17.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-137 advisory.

    On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root     when the final path component of the a path is a symbolic link and the path ends in /. For example,     'root.Open(symlink/)' will open symlink even when symlink is a symbolic link pointing outside of the     root. (CVE-2026-39822)

    Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a     disclosure of pre-shared key identities in the unencrypted client hello. (CVE-2026-42505)

    A flaw was found in Rekor. The `Package.Unmarshal()` function, which processes Alpine Package Keep (APK)     files, decompresses gzip streams without limiting the total decompressed size. A remote attacker can     exploit this by crafting a malicious APK file with a high compression ratio, causing the server to consume     excessive memory. This leads to a Denial of Service (DoS) through an out-of-memory (OOM) error, and can be     triggered via unauthenticated API endpoints. (CVE-2026-48702)

    A flaw was found in Fulcio's OpenID Connect (OIDC) Discovery client. This vulnerability allows a remote     attacker to perform Server-Side Request Forgery (SSRF) by redirecting discovery requests to internal     systems. Additionally, an attacker can manipulate the JSON Web Key Set (JWKS) Uniform Resource Identifier     (URI) to poison the verifier cache with malicious keys, enabling the validation of attacker-controlled     signatures. Furthermore, the flaw can lead to the leakage of Kubernetes ServiceAccount tokens to third-     party hosts through cross-host redirects or misconfigured MetaIssuers, potentially exposing sensitive     cluster credentials. (CVE-2026-49478)

    A flaw was found in Sigstore Timestamp Authority. An unauthenticated remote attacker can exploit this     vulnerability by sending requests with arbitrary HTTP paths and methods. This leads to the creation of an     excessive number of unique metric labels, causing unbounded memory growth and a denial of service (DoS)     condition on the server. This issue is a type of Improper Restriction of Resource Consumption (CWE-770).
    (CVE-2026-49835)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2023 advisory.

    On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root     when the final path component of the a path is a symbolic link and the path ends in /. For example,     'root.Open(symlink/)' will open symlink even when symlink is a symbolic link pointing outside of the     root. (CVE-2026-39822)

    Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a     disclosure of pre-shared key identities in the unencrypted client hello. (CVE-2026-42505)

    A flaw was found in Rekor. The `Package.Unmarshal()` function, which processes Alpine Package Keep (APK)     files, decompresses gzip streams without limiting the total decompressed size. A remote attacker can     exploit this by crafting a malicious APK file with a high compression ratio, causing the server to consume     excessive memory. This leads to a Denial of Service (DoS) through an out-of-memory (OOM) error, and can be     triggered via unauthenticated API endpoints. (CVE-2026-48702)

    A flaw was found in Fulcio's OpenID Connect (OIDC) Discovery client. This vulnerability allows a remote     attacker to perform Server-Side Request Forgery (SSRF) by redirecting discovery requests to internal     systems. Additionally, an attacker can manipulate the JSON Web Key Set (JWKS) Uniform Resource Identifier     (URI) to poison the verifier cache with malicious keys, enabling the validation of attacker-controlled     signatures. Furthermore, the flaw can lead to the leakage of Kubernetes ServiceAccount tokens to third-     party hosts through cross-host redirects or misconfigured MetaIssuers, potentially exposing sensitive     cluster credentials. (CVE-2026-49478)

    A flaw was found in Sigstore Timestamp Authority. An unauthenticated remote attacker can exploit this     vulnerability by sending requests with arbitrary HTTP paths and methods. This leads to the creation of an     excessive number of unique metric labels, causing unbounded memory growth and a denial of service (DoS)     condition on the server. This issue is a type of Improper Restriction of Resource Consumption (CWE-770).
    (CVE-2026-49835)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2,     the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control     gzip members of an APK file into in-memory buffers without bounding the total decompressed size. The     existing `max_apk_metadata_size` check (default 1MB) is only applied to individual tar entry header sizes     after decompression completes, so it does not prevent a decompression bomb from consuming unbounded heap     memory. An attacker can craft a gzip stream that compresses at a ~1000:1 ratio (e.g., 2MB compressed zeros      2GB decompressed). When submitted as spec.package.content in an Alpine `ProposedEntry`, the server     decompresses the full payload into memory during request processing, triggering a fatal Go runtime out-of-     memory error or OS OOM-kill that cannot be caught by the server's recover() middleware. This is reachable     via two unauthenticated endpoints, `POST /api/v1/log/entries (createLogEntry)` and `POST     /api/v1/log/entries/retrieve (searchLogQuery)`. Both invoke `V001Entry.Canonicalize()`     `fetchExternalEntities()`  `apk.Unmarshal(packageData)`, which performs the unbounded decompression.
    Version 1.5.2 patches the issue. There is no effective workaround. Setting `max_request_body_size` reduces     but does not eliminate exposure due to the ~1000:1 compression ratio (a 1MB body limit still allows ~1GB     heap allocation). Setting `max_apk_metadata_size` has no effect on this vulnerability since the check is     applied after decompression. (CVE-2026-48702)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21262-1 advisory.

    Changes in hauler:

    - update to 2.0.1 (bsc#1269433, CVE-2026-48702):
      * bump go to 1.26.4 to squash CVE noise
      * Full v2 Release notes: https://github.com/hauler-         dev/hauler/releases/tag/v2.0.0

    - update to 2.0.0:
      * `v2.0.0` is a **major** release. It replaces Hauler's entire         OCI plumbing... the ORAS v1 dependency and the in-house         cosign fork with a native containerd based implementation,         drops the deprecated `v1alpha1` API, and layers on a         meaningful set of new capabilities and reliability fixes on         top of that new foundation.
      * **Removed the ORAS v1 dependency** - push/pull is now driven         directly by containerd's docker resolver and `google/go-         containerregistry`, new `pkg/content/registry.go`         (`RegistryTarget`) and `pkg/content/types.go` (`Target`         interface, `IoContentWriter`) replaces what ORAS used to own.
      * **Removed the hauler-maintained cosign fork** - `pkg/cosign`         is now a thin verify only wrapper around upstream         `sigstore/cosign/v3`. Images are added through a native         `s.AddImage()` path in `pkg/store`
      * **Added OCI 1.1 Referrers support** - signatures,         attestations, and SBOMs are discovered both via the classic         cosign tag convention (`sha256-.sig` / `.att` / `.sbom`) and         the modern Referrers API, then correctly through the OCI         layout

    - update x/net to v0.55.0 (bsc#1266602, CVE-2026-39821,          bsc#1267150, CVE-2026-25680, CVE-2026-42502, CVE-2026-27136,          CVE-2026-25681, CVE-2026-42506)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2,
    the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control
    gzip members of an APK file into in-memory buffers without bounding the total decompressed size. The
    existing `max_apk_metadata_size` check (default 1MB) is only applied to individual tar entry header sizes
    after decompression completes, so it does not prevent a decompression bomb from consuming unbounded heap
    memory. An attacker can craft a gzip stream that compresses at a ~1000:1 ratio (e.g., 2MB compressed zeros
    → 2GB decompressed). When submitted as spec.package.content in an Alpine `ProposedEntry`, the server
    decompresses the full payload into memory during request processing, triggering a fatal Go runtime out-of-
    memory error or OS OOM-kill that cannot be caught by the server's recover() middleware. This is reachable
    via two unauthenticated endpoints, `POST /api/v1/log/entries (createLogEntry)` and `POST
    /api/v1/log/entries/retrieve (searchLogQuery)`. Both invoke `V001Entry.Canonicalize()` →
    `fetchExternalEntities()` → `apk.Unmarshal(packageData)`, which performs the unbounded decompression.
    Version 1.5.2 patches the issue. There is no effective workaround. Setting `max_request_body_size` reduces
    but does not eliminate exposure due to the ~1000:1 compression ratio (a 1MB body limit still allows ~1GB
    heap allocation). Setting `max_apk_metadata_size` has no effect on this vulnerability since the check is
    applied after decompression. (CVE-2026-48702)

ID	Name	Product	Family	Type	Severity
332018	Amazon Linux 2 : runfinch-finch, --advisory ALAS2DOCKER-2026-137 (ALASDOCKER-2026-137)	Nessus	Amazon Linux Local Security Checks	Local	high
332009	Amazon Linux 2023 : runfinch-finch (ALAS2023-2026-2023)	Nessus	Amazon Linux Local Security Checks	Local	high
330137	Linux Distros Unpatched Vulnerability : CVE-2026-48702	Nessus	Misc.	Local	high
326035	openSUSE 16 Security Update : hauler (openSUSE-SU-2026:21262-1)	Nessus	SuSE Local Security Checks	Local	medium
443954	SCA: security update for github.com/sigstore/rekor (GHSA-47q9-m4ww-924m)	Tenable Cloud Security	SCA Checks	Local	high
443954	SCA: security update for github.com/sigstore/rekor (GHSA-47q9-m4ww-924m)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-48702

high

Tenable Plugins

high

high

high

medium

high

high