242 matches found
UBUNTU-CVE-2026-55588
ORAS OCI Registry As Storage is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded...
CVE-2026-55588
ORAS OCI Registry As Storage is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded...
CVE-2026-55588 ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption
ORAS OCI Registry As Storage is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded...
CVE-2026-55588 ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption
ORAS OCI Registry As Storage is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded...
CVE-2026-55588
ORAS OCI Registry As Storage is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded...
CVE-2026-55588
ORAS CLI (OCI Registry As Storage) versions up to and including 1.3.2 contain a client-side denial-of-service vulnerability in the recursive referrer traversal. The traversal does not track visited descriptors, so a malicious OCI registry returning a cyclic referrer graph (e.g., A→B→A) triggers u...
CVE-2026-55588
ORAS OCI Registry As Storage is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded...
CVE-2026-55588 ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption
ORAS OCI Registry As Storage is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded...
CVE-2026-55588: Uncontrolled Resource Consumption
ORAS OCI Registry As Storage is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded...
PT-2026-81849
Name of the Vulnerable Software and Affected Versions ORAS CLI versions prior to 1.3.3 Description Recursive referrer traversal fails to track visited descriptors, allowing a malicious OCI registry to return a cyclic referrer graph. This leads to unbounded recursion and memory growth, resulting i...
GO-2026-5882 vulnerabilities
Vulnerabilities for packages: steampipe, ocm-cli-fips, cert-manager-cmctl, ocm-cli, ratify-fips, helm, rancher-fleet-fips, falcoctl-fips, gitlab-operator, helm-operator-fips, chaos-mesh, eksctl, kyverno-notation-aws-fips, vcluster, kubescape, argo-cd, kubescape-server-fips, oras-fips,...
GO-2026-5880 vulnerabilities
Vulnerabilities for packages: argocd-image-updater, steampipe, helm-mapkubeapis, cert-manager-cmctl, grafana-operator, gogatekeeper, opa, rancher-agent, rancher-helm, helm, k9s, opa-envoy, flux-source-controller, zot, kyverno, xeol, headlamp, linkerd2, rancher, cilium-cli,...
GO-2026-4601 vulnerabilities
Vulnerabilities for packages: cass-operator, azcopy, k8ssandra-operator, runc, helm, gitlab-runner, kubernetes-replicator, kuberlr, nri-apache, cri-tools, opensearch-k8s-operator, metrics-agent, git-sync, secrets-store-csi-driver-provider-aws, nri-nginx, containerd, cerbos, cilium, step-ca,...
GO-2026-4946 vulnerabilities
Vulnerabilities for packages: k8ssandra-operator, runc, minio-operator, crossplane-provider-azure-sql, helm, grpcurl, argo-workflows, etcd, kubernetes-replicator, kuberlr, nri-apache, caddy, direnv, cri-tools, aactl, opensearch-k8s-operator, metrics-agent, jitsucom-bulker, git-sync,...
SUSE-SU-2026:23052-1 Security update for helm
This update for helm fixes the following issues Update to version 3.21.3. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266598. - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth:...
Security Bulletin: Sterling Order Management System Software, (On prem)
Summary Multiple vulnerabilities were addressed in Sterling Order Management System Software, On prem : 10.0.2607.0-Sterling-SSFF-All-Major-Update-Installer Vulnerability Details CVEID:CVE-2026-48978 DESCRIPTION: oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client...
Security update for trivy (important)
openSUSE Security Update: Security update for trivy Announcement ID: openSUSE-SU-2026:0263-1 Rating: important References: 1266495 1268356 1269269 1269271 1271658 1271670 Cross-References: CVE-2026-39821 CVE-2026-46680 CVE-2026-50151 CVE-2026-54448 CVE-2026-55092 CVE-2026-56852 CVSS scores:...
GO-2026-5882 Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go
Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go...