Rekor, a supply‑chain transparency log, suffers from a nil pointer dereference when canonicalizing a COSE v0.0.1 entry that has an empty spec.message field. If an attacker submits such a malformed entry, the validate() function returns success without initializing sign1Msg, and later Canonicalize() dereferences the uninitialized payload, causing a panic. The panic is caught, a 500 error is returned to the client, and the service continues to run, so the main impact observed is a brief denial‑of‑service for that request.

The flaw affects all sigstore:rekor installations using version 1.4.3 or earlier. It is fixed in version 1.5.0. Any deployment of Rekor that accepts externally constructed COSE entries is potentially exposed.

The vulnerability has a CVSS score of 5.3 indicating medium severity. The EPSS score is < 1%, indicating a very low likelihood of exploitation. Rekor is exposed over the network through its entry ingestion APIs. The likely attack vector is an attacker submitting a malicious COSE v0.0.1 entry with an empty spec.message field by means of an unauthenticated HTTP request if the endpoint permits such submissions; this inference is based on the description of the API exposure and lack of authentication constraints. The exploit would trigger a panic that is recovered, causing a 500 error for that specific request, and the overall service remains available, so the impact is limited to a single request and does not provide persistence or broader compromise.