Rekor versions >=0.3.0 and <1.5.2 contain a resource exhaustion vulnerability (CWE-770) in the Package.Unmarshal() function within pkg/types/alpine/apk.go. This function decompresses gzip-compressed signature and control members of Alpine APK files into memory without bounding the decompressed size, allowing crafted gzip streams with extreme compression ratios (~1000:1) to cause excessive heap memory allocation. The existing max_apk_metadata_size limit applies only after decompression, failing to prevent decompression bombs. The vulnerability is reachable via unauthenticated POST requests to /api/v1/log/entries and /api/v1/log/entries/retrieve endpoints, which invoke the vulnerable decompression code path. Exploitation results in fatal Go runtime out-of-memory errors or OS-level OOM kills, which cannot be recovered by the server middleware. Version 1.5.2 patches this vulnerability. No effective workaround is available; limiting max_request_body_size reduces but does not eliminate risk due to the high decompression ratio.

An attacker can cause the Rekor server to consume excessive memory by submitting specially crafted gzip-compressed payloads, leading to fatal out-of-memory errors or the operating system terminating the process. This results in denial of service (DoS) of the affected service. The vulnerability does not impact confidentiality or integrity but causes availability disruption. The attack requires no authentication and can be triggered remotely via two API endpoints.

Version 1.5.2 of Rekor includes an official fix that addresses this vulnerability. Users should upgrade to version 1.5.2 or later to remediate the issue. There is no effective workaround; limiting max_request_body_size can reduce but not eliminate the risk due to the high compression ratio of the exploit payload. The max_apk_metadata_size setting does not mitigate this vulnerability as it applies only after decompression. Operators should prioritize patching to prevent denial of service.