ExtractPluginFromImage() function DoS

The vulnerability of the ExtractPluginFromImage function in the OCI plugin loader of the secrets and encryption management system OpenBao involves an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

CVE-2026-39396

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, "ExtractPluginFromImage" in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via "io.Copy" with no upper bound on the number of bytes...

CVE-2026-39396: Uncontrolled Resource Consumption

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, ExtractPluginFromImage in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via io.Copy with no upper bound on the number of bytes written. ...