Affected by GO-2026-4354 and 1 other vulnerabilities

GO-2026-4354: Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty Message in github.com/sigstore/rekor

GO-2026-4355: Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL in github.com/sigstore/rekor

pkg/

Details

Path	Synopsis
api
client
fuzz
generated
client
client/entries
client/index
client/pubkey
client/tlog
models
restapi Package restapi Rekor	Package restapi Rekor
restapi/operations
restapi/operations/entries
restapi/operations/index
restapi/operations/pubkey
restapi/operations/tlog
log
pki
minisign
pgp
pkcs7
ssh
tuf
x509
x509/testutils
sharding
signer
storage
trillianclient
types
alpine
alpine/v0.0.1
cose
cose/v0.0.1
dsse
dsse/v0.0.1
hashedrekord
hashedrekord/v0.0.1
helm
helm/v0.0.1
intoto
intoto/v0.0.1
intoto/v0.0.2
jar
jar/v0.0.1
rekord
rekord/v0.0.1
rfc3161
rfc3161/v0.0.1
rpm
rpm/v0.0.1
tuf
tuf/v0.0.1
util
verify
witness
mockclient Package mockclient provides a mockable version of the Trillian log client API.	Package mockclient provides a mockable version of the Trillian log client API.