VDB
GO-2026-4354
GO-2026-4354
PUBLISHED
Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty Message in github.com/sigstore/rekor
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | image-factory-fips | 0, 0, 0 |
| wolfi | skaffold | 0, 0, 0 |
| wolfi | policy-controller | 0, 0, 0 |
| chainguard | cloudbeat-fips-9.0 | 0, 0, 0 |
| chainguard | kyverno-policy-reporter-plugins-kyverno | 0, 0, 0 |
| chainguard | crossplane-1.20 | 0, 0, 0 |
| wolfi | falcoctl | 0, 0, 0 |
| chainguard | cloudbeat-9.2 | 0, 0, 0 |
| wolfi | neuvector-sigstore-interface | 0, 0, 0 |
| wolfi | ratify | 0, 0, 0 |
| chainguard | tflint | 0, 0, 0 |
| chainguard | kyverno-1.16 | 0, 0, 0 |
| chainguard | aactl | 0, 0, 0 |
| chainguard | cloudbeat-8.17 | 0, 0, 0 |
| wolfi | zot | 0, 0, 0 |
| chainguard | crossplane-2.0 | 0, 0, 0 |
| chainguard | goreleaser | 0, 0, 0 |
| chainguard | teleport-18 | 0, 0, 0 |
| chainguard | zarf | 0, 0, 0 |
| chainguard | kyverno-fips-1.15 | 0, 0, 0 |
…and 82 more
Timeline
- Feb 2, 2026 CVE Published
- Feb 4, 2026 CVE Updated
- May 18, 2026 Security Advisory