{"id":"EUVD-2026-57928","enisaUuid":"44cacb37-7015-3fe5-ad6f-b2a9f0d020c4","description":"Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size. The existing `max_apk_metadata_size` check (default 1MB) is only applied to individual tar entry header sizes after decompression completes, so it does not prevent a decompression bomb from consuming unbounded heap memory. An attacker can craft a gzip stream that compresses at a ~1000:1 ratio (e.g., 2MB compressed zeros → 2GB decompressed). When submitted as spec.package.content in an Alpine `ProposedEntry`, the server decompresses the full payload into memory during request processing, triggering a fatal Go runtime out-of-memory error or OS OOM-kill that cannot be caught by the server\u0027s recover() middleware. This is reachable via two unauthenticated endpoints, `POST /api/v1/log/entries (createLogEntry)` and `POST /api/v1/log/entries/retrieve (searchLogQuery)`. Both invoke `V001Entry.Canonicalize()` → `fetchExternalEntities()` → `apk.Unmarshal(packageData)`, which performs the unbounded decompression. Version 1.5.2 patches the issue. There is no effective workaround. Setting `max_request_body_size` reduces but does not eliminate exposure due to the ~1000:1 compression ratio (a 1MB body limit still allows ~1GB heap allocation). Setting `max_apk_metadata_size` has no effect on this vulnerability since the check is applied after decompression.","datePublished":"Aug 13, 2026, 1:14:19 PM","dateUpdated":"Aug 13, 2026, 3:16:26 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/sigstore/rekor/security/advisories/GHSA-47q9-m4ww-924m\n","aliases":"CVE-2026-48702\nGHSA-47q9-m4ww-924m\n","assigner":"GitHub_M","epss":0.46,"enisaIdProduct":[{"id":"fd031dd2-d17d-3d45-9127-15ac4589138d","product":{"name":"rekor","vendor":{"name":"sigstore"}},"product_version":"0.3.0, \u003c 1.5.2"}],"enisaIdVendor":[{"id":"f51d72ed-c8df-3578-9a20-0420503f8d20","vendor":{"name":"sigstore"}}],"enisaIdVulnerability":[{"id":"2d38d16b-fd77-3284-926c-c210029e1f8d","vulnerability":{"id":"GHSA-47q9-m4ww-924m","description":"Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic","datePublished":"Jun 25, 2026, 9:33:36 PM","dateUpdated":"Jun 25, 2026, 9:33:36 PM","baseScore":0.0,"references":"https://github.com/sigstore/rekor/security/advisories/GHSA-47q9-m4ww-924m\nhttps://github.com/sigstore/rekor\n","enisa_id":"EUVD-2026-57928\n","aliases":"GHSA-47q9-m4ww-924m\nCVE-2026-48702\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"90eeb1a0-3fac-3544-b598-492afd7eb633","vulnerability":{"id":"CVE-2026-48702","description":"Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size. The existing `max_apk_metadata_size` check (default 1MB) is only applied to individual tar entry header sizes after decompression completes, so it does not prevent a decompression bomb from consuming unbounded heap memory. An attacker can craft a gzip stream that compresses at a ~1000:1 ratio (e.g., 2MB compressed zeros → 2GB decompressed). When submitted as spec.package.content in an Alpine `ProposedEntry`, the server decompresses the full payload into memory during request processing, triggering a fatal Go runtime out-of-memory error or OS OOM-kill that cannot be caught by the server\u0027s recover() middleware. This is reachable via two unauthenticated endpoints, `POST /api/v1/log/entries (createLogEntry)` and `POST /api/v1/log/entries/retrieve (searchLogQuery)`. Both invoke `V001Entry.Canonicalize()` → `fetchExternalEntities()` → `apk.Unmarshal(packageData)`, which performs the unbounded decompression. Version 1.5.2 patches the issue. There is no effective workaround. Setting `max_request_body_size` reduces but does not eliminate exposure due to the ~1000:1 compression ratio (a 1MB body limit still allows ~1GB heap allocation). Setting `max_apk_metadata_size` has no effect on this vulnerability since the check is applied after decompression.","datePublished":"Aug 13, 2026, 1:14:19 PM","dateUpdated":"Aug 13, 2026, 3:16:26 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/sigstore/rekor/security/advisories/GHSA-47q9-m4ww-924m\n","enisa_id":"EUVD-2026-57928\n","assigner":"GitHub_M","epss":0.46,"dataProcessed":"Nov 1, 2026, 7:19:35 AM","vulnerabilityProduct":[{"id":"79dd3f25-6c19-316d-8944-88b48d38c00c","product":{"name":"rekor","vendor":{"name":"sigstore"}},"product_version":"0.3.0, \u003c 1.5.2"}],"vulnerabilityVendor":[{"id":"9e06f3e8-e908-3b70-a5fd-72c2b3d75ac9","vendor":{"name":"sigstore"}}]}}],"enisaIdAdvisory":[{"id":"5c54ca72-6810-3051-8fb0-c2b5443a67ce","advisory":{"id":"openSUSE-SU-2026:11398-1","description":"tekton-cli-0.45.1-1.1 on GA media","summary":"tekton-cli-0.45.1-1.1 on GA media","datePublished":"Jul 28, 2026, 12:00:00 AM","dateUpdated":"Sep 17, 2026, 5:17:10 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11398-1.json\nhttps://www.suse.com/security/cve/CVE-2026-48702/\nhttps://www.suse.com/security/cve/CVE-2026-49835/\n","aliases":"CVE-2026-48702\nCVE-2026-49835\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"0a622ac1-67f5-3833-83aa-3c78ccd3e7af","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"0b0b6f38-1292-3237-8e84-899b5767e56a","product":{"name":"tekton-cli-zsh-completion-0:0.45.1-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"10b73e21-3017-3987-9893-cf4329a9821d","product":{"name":"tekton-cli-fish-completion-0:0.45.1-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"1cb2b42a-53b5-3da3-ad91-1f5a3b0114fc","product":{"name":"tekton-cli-bash-completion-0:0.45.1-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"30574918-3d67-3d7f-a12c-13611c631916","product":{"name":"tekton-cli-0:0.45.1-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"31b73b61-84a7-3766-9b15-e5ac4c392eda","product":{"name":"tekton-cli-bash-completion-0:0.45.1-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"54bab3d6-746e-3f68-8be6-6adba47cd875","product":{"name":"tekton-cli-fish-completion-0:0.45.1-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"6fb9f619-7f68-3723-9f60-67e810beb18f","product":{"name":"tekton-cli-bash-completion-0:0.45.1-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"74bf7990-9bb3-3d4d-97de-ff8433868811","product":{"name":"tekton-cli-zsh-completion-0:0.45.1-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"804fe655-6073-3d68-8bf1-fa324cb07ca7","product":{"name":"tekton-cli-0:0.45.1-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"98fdc09f-baf1-342d-a26c-a67fb4359b16","product":{"name":"tekton-cli-0:0.45.1-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"a3ba8c9a-f96e-382c-9575-5c0c7c4fc6a1","product":{"name":"tekton-cli-bash-completion-0:0.45.1-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"ae8a402b-52b5-3896-b46a-496e26e3424e","product":{"name":"tekton-cli-fish-completion-0:0.45.1-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"cd363784-7e4c-3456-b1dd-d50b7a955c6f","product":{"name":"tekton-cli-0:0.45.1-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"de92b6fe-ba81-3ae2-af08-7644be0726fa","product":{"name":"tekton-cli-zsh-completion-0:0.45.1-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"e000ec5e-6fc0-3d05-ac2d-193cbbf85872","product":{"name":"tekton-cli-fish-completion-0:0.45.1-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"ee0736f1-7371-3b1c-88dc-6da7823854b2","product":{"name":"tekton-cli-zsh-completion-0:0.45.1-1.1.aarch64","vendor":{"name":"SUSE"}}}]}},{"id":"6f334467-dc67-3ac2-9f56-54b1de20d0b0","advisory":{"id":"RHSA-2026:35111","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Jul 2, 2026, 11:34:03 PM","dateUpdated":"Oct 31, 2026, 9:32:02 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:35111\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_35111.json\n","aliases":"CVE-2026-32285\nCVE-2026-41506\nCVE-2026-44740\nCVE-2026-46680\nCVE-2026-47262\nCVE-2026-48702\nCVE-2026-50195\nCVE-2026-53488\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"039daae5-52b4-3ee5-bad0-fc77b93eadbf","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"22bcdc22-1ff3-38e1-a802-66f02e4063a1","product":{"name":"trivy-0:0.72.0-0.1.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"2428618e-d214-324a-b18e-10559285d737","product":{"name":"trivy-main@aarch64","vendor":{"name":"Red Hat"}}},{"id":"3b93ef49-8b8d-34d1-95f7-0c2851bac2b4","product":{"name":"trivy-0:0.72.0-0.1.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"b8437952-66dd-3f59-a7c2-259f0d5b69b4","product":{"name":"trivy-main@x86_64","vendor":{"name":"Red Hat"}}},{"id":"ba092ff3-060f-379f-a05e-23d479775576","product":{"name":"trivy-main@src","vendor":{"name":"Red Hat"}}},{"id":"fe560247-b78f-3778-bdbf-8f6e9c650c37","product":{"name":"trivy-0:0.72.0-0.1.hum1@src","vendor":{"name":"Red Hat"}}}]}},{"id":"88ac08c0-2703-321d-b394-1c2a217ba443","advisory":{"id":"RHSA-2026:25138","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Jun 10, 2026, 9:27:43 PM","dateUpdated":"Oct 30, 2026, 7:36:16 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:25138\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25138.json\n","aliases":"CVE-2026-41889\nCVE-2026-45287\nCVE-2026-48702\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"0c107dc9-494c-3dd8-a772-f8cfdd34f58f","product":{"name":"cosign-main@src","vendor":{"name":"Red Hat"}}},{"id":"3e393172-78b9-3234-96fe-37584d0febdf","product":{"name":"cosign-0:3.1.1-0.1.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"46c0a38e-9225-3233-bc48-ebd4b7382979","product":{"name":"cosign-main@aarch64","vendor":{"name":"Red Hat"}}},{"id":"6b08f7ff-c8a3-3a8d-b437-e5126a807c33","product":{"name":"cosign-0:3.1.1-0.1.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"812ef8f8-380f-3832-823f-4df8c7f9a499","product":{"name":"cosign-main@x86_64","vendor":{"name":"Red Hat"}}},{"id":"cd2f9235-8c74-3722-a5bf-09954934f3c8","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"d90ac49f-bb5a-3bef-b38f-fc9fe464ac36","product":{"name":"cosign-0:3.1.1-0.1.hum1@x86_64","vendor":{"name":"Red Hat"}}}]}},{"id":"8aadcec4-8c9d-37b6-92d7-e883820aec78","advisory":{"id":"openSUSE-SU-2026:11154-1","description":"hauler-2.0.1-1.1 on GA media","summary":"hauler-2.0.1-1.1 on GA media","datePublished":"Jun 30, 2026, 12:00:00 AM","dateUpdated":"Sep 17, 2026, 5:12:07 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11154-1.json\nhttps://www.suse.com/security/cve/CVE-2026-48702/\n","aliases":"CVE-2026-48702\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"215db3a4-adb2-33cd-b303-f6cffd0b3e42","product":{"name":"hauler-0:2.0.1-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"23922a0c-f356-351f-a285-cac15f0a8e3e","product":{"name":"hauler-0:2.0.1-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"8ad492e7-4a62-34de-a302-78f911641bff","product":{"name":"hauler-0:2.0.1-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"eecdc26e-0e54-3229-b0cb-e5d3209a373d","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"f52889c8-37f7-3c25-8fe8-f61be52760f9","product":{"name":"hauler-0:2.0.1-1.1.x86_64","vendor":{"name":"SUSE"}}}]}},{"id":"9ed0b5c5-d690-345d-84be-6300046e7922","advisory":{"id":"openSUSE-SU-2026:21262-1","description":"Security update for hauler","summary":"Security update for hauler","datePublished":"Jul 6, 2026, 9:02:35 AM","dateUpdated":"Sep 17, 2026, 5:38:06 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21262-1.json\nhttps://bugzilla.suse.com/1267150\nhttps://bugzilla.suse.com/1269433\nhttps://www.suse.com/security/cve/CVE-2026-25680/\nhttps://www.suse.com/security/cve/CVE-2026-25681/\nhttps://www.suse.com/security/cve/CVE-2026-27136/\nhttps://www.suse.com/security/cve/CVE-2026-42502/\nhttps://www.suse.com/security/cve/CVE-2026-42506/\nhttps://www.suse.com/security/cve/CVE-2026-48702/\n","aliases":"CVE-2026-25680\nCVE-2026-25681\nCVE-2026-27136\nCVE-2026-42502\nCVE-2026-42506\nCVE-2026-48702\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"1cff8ee2-7e41-3645-a8a2-10b04c1a5b39","product":{"name":"hauler-0:2.0.1-bp160.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"7388c06e-5c18-3120-b27c-8b3003ad0c3b","product":{"name":"openSUSE Leap 16.0","vendor":{"name":"SUSE"}}},{"id":"bc3269e2-34f9-394c-bb1d-1e694df972ca","product":{"name":"hauler-0:2.0.1-bp160.1.1.aarch64","vendor":{"name":"SUSE"}}}]}},{"id":"d13e1d52-3f95-3244-ba44-79fadbfc184f","advisory":{"id":"RHSA-2026:50873","description":"Red Hat Security Advisory: RHTAS 1.4.3 - Red Hat Trusted Artifact Signer Release","summary":"The 1.4.3 release of Red Hat Trusted Artifact Signer OpenShift Operator.\nFor more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4","datePublished":"Aug 5, 2026, 5:55:16 PM","dateUpdated":"Oct 31, 2026, 5:43:11 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:50873\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50873.json\n","aliases":"CVE-2026-39831\nCVE-2026-46597\nCVE-2026-48702\nCVE-2026-59869\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"0051ce65-e186-3ded-9bfc-bf42df1eba5c","product":{"name":"registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:0c392cea88e98bed79228bedd39e5f046945277147c44cec1f15d2f756e84da3_amd64","vendor":{"name":"Red Hat"}}},{"id":"31d20aae-412a-362c-acc6-b5057b67ca93","product":{"name":"registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:414b330788915c554e162ad87da9dcb62b0bc44f50ea4fb9586c1a1b61d6e47e_amd64","vendor":{"name":"Red Hat"}}},{"id":"5051e23a-f0b0-3efe-926c-d9fa64e72cd6","product":{"name":"Red Hat Trusted Artifact Signer 1.4","vendor":{"name":"Red Hat"}}},{"id":"87b401ad-cfca-3f05-b7cc-c95c0c202b6e","product":{"name":"registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:e3a8872b1ffd7282ec1133fcc7826682fb77c09e3d44cc2394bf9113dcb1e34c_amd64","vendor":{"name":"Red Hat"}}},{"id":"8cdb4030-ac7d-3cd2-9b9d-f8d02d03e918","product":{"name":"registry.redhat.io/rhtas/trillian-database-rhel9@sha256:fa963e4b0f7c6ee46d84f9a5e5e31445d659db80e08a90e0927646bc24c1e53b_amd64","vendor":{"name":"Red Hat"}}},{"id":"a51c6daa-f917-3362-90bd-4ec0a9201514","product":{"name":"registry.redhat.io/rhtas/fulcio-rhel9@sha256:0996775ede985a6b2b1ada6045c1ab4d60d16977d7087326ee14988e28be87e6_amd64","vendor":{"name":"Red Hat"}}},{"id":"b94e5936-2481-37ef-a649-ee7119754545","product":{"name":"registry.redhat.io/rhtas/rekor-server-rhel9@sha256:b0264e38a58995d26b27042c23c023a410c9632f472c56db85db5a5fef96bb85_amd64","vendor":{"name":"Red Hat"}}},{"id":"ddc7797f-c489-3f21-a716-f43d781a5a69","product":{"name":"registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:5a07b75ddd1a925c85b22cba4eac9317370e5fc9ca01d79e7a6414246171bb90_amd64","vendor":{"name":"Red Hat"}}},{"id":"e56ccbdf-a421-3362-826b-6d131fa8b7a4","product":{"name":"registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:f56e3c3845c4d37ec8b47f6dc00dec4186cba95b66ae88c99b4969eea3eb56e1_amd64","vendor":{"name":"Red Hat"}}},{"id":"e86dbbab-7f1a-3c95-a748-f5f552bdc03e","product":{"name":"registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:e9d5ddcfdebb4c728bbdc5b305216d372d6d880dd7c85fadb6df7bed6b47a8d2_amd64","vendor":{"name":"Red Hat"}}},{"id":"fa79728e-8da0-3b81-868b-6bf4f65376dc","product":{"name":"registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:ac76a66ffeffbccea272181936686f4160f190f5575c8b27357a1b8e4f5640b7_amd64","vendor":{"name":"Red Hat"}}}]}},{"id":"db08077f-43b4-3307-a263-1d45e94d619a","advisory":{"id":"RHSA-2026:59439","description":"Red Hat Security Advisory: RHTAS 1.3.7 - Red Hat Trusted Artifact Signer Release","summary":"The 1.3.7 release of Red Hat Trusted Artifact Signer OpenShift Operator.\nFor more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3","datePublished":"Aug 25, 2026, 1:53:52 PM","dateUpdated":"Oct 31, 2026, 5:43:29 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:59439\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59439.json\n","aliases":"CVE-2024-9355\nCVE-2025-7783\nCVE-2025-47907\nCVE-2026-48702\nCVE-2026-59869\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"0c640459-8cf4-37b2-83e6-b7fd08f3bf89","product":{"name":"Red Hat Trusted Artifact Signer 1.3","vendor":{"name":"Red Hat"}}},{"id":"0cc84374-62c8-356d-9fd4-bc579da4043e","product":{"name":"registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64","vendor":{"name":"Red Hat"}}},{"id":"2db98468-d539-363a-955a-ca2c79194267","product":{"name":"registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64","vendor":{"name":"Red Hat"}}},{"id":"31aa69d7-a734-3d05-962a-bf1ea9a6f1f0","product":{"name":"registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64","vendor":{"name":"Red Hat"}}},{"id":"5edc673d-67b1-35f6-a2be-e6eb7c8e2371","product":{"name":"registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64","vendor":{"name":"Red Hat"}}},{"id":"8ff28084-7a42-3cc6-b711-1228e25dc477","product":{"name":"registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64","vendor":{"name":"Red Hat"}}},{"id":"91ba590b-c134-3881-ba15-910073c692fd","product":{"name":"registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64","vendor":{"name":"Red Hat"}}},{"id":"936eb050-de1e-3bee-aafa-82361e24574a","product":{"name":"registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64","vendor":{"name":"Red Hat"}}},{"id":"9f848967-f00a-3bc8-aa1d-3769671775ec","product":{"name":"registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64","vendor":{"name":"Red Hat"}}},{"id":"ca480323-88a9-34f2-bc59-45f485e108b0","product":{"name":"registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64","vendor":{"name":"Red Hat"}}},{"id":"ce14b7d8-341a-35c0-9395-fba805d2b5b7","product":{"name":"registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64","vendor":{"name":"Red Hat"}}}]}}]}