Listen to this Post
The vulnerability in Rekor’s cose v0.0.1 entry type arises from a nil pointer dereference during the canonicalization process. When a proposed entry with an empty spec.message is submitted, the .validate() method incorrectly returns nil, indicating success, while leaving the internal sign1Msg field uninitialized. Subsequently, when Canonicalize() is invoked, it attempts to dereference v.sign1Msg.Payload, which is nil, causing a panic. This panic is recovered within the Rekor process, so the client receives a 500 error message, and service continues, limiting availability impact. The issue stems from insufficient validation of the message field, allowing attacker-controlled input to trigger the panic. Patches address this by ensuring proper initialization before dereferencing.
Platform: Rekor
Version: cose v0.0.1
Vulnerability: Nil pointer dereference
Severity: Moderate
Date: Jan 22 2026
Prediction: Patched v1.5.0
What Undercode Say:
Analytics
Bash command: git clone https://github.com/sigstore/rekor.git
Code: func (v V001Entry) Canonicalize() { if v.sign1Msg == nil { panic(“nil sign1Msg”) } }
Exploit
Send empty message
Protection from this CVE
Upgrade to v1.5.0
Impact
Thread panic recovered
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
