242 matches found
UBUNTU-CVE-2026-55588
ORAS OCI Registry As Storage is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded...
CVE-2026-55588
ORAS OCI Registry As Storage is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded...
CVE-2026-55588 ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption
ORAS OCI Registry As Storage is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded...
CVE-2026-55588 ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption
ORAS OCI Registry As Storage is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded...
CVE-2026-55588
ORAS CLI (OCI Registry As Storage) versions up to and including 1.3.2 contain a client-side denial-of-service vulnerability in the recursive referrer traversal. The traversal does not track visited descriptors, so a malicious OCI registry returning a cyclic referrer graph (e.g., A→B→A) triggers u...
CVE-2026-55588 ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption
ORAS OCI Registry As Storage is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded...
CVE-2026-55588
ORAS OCI Registry As Storage is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded...
CVE-2026-55588
ORAS OCI Registry As Storage is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded...
CVE-2026-55588: Uncontrolled Resource Consumption
ORAS OCI Registry As Storage is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded...
PT-2026-81849
Name of the Vulnerable Software and Affected Versions ORAS CLI versions prior to 1.3.3 Description Recursive referrer traversal fails to track visited descriptors, allowing a malicious OCI registry to return a cyclic referrer graph. This leads to unbounded recursion and memory growth, resulting i...
GO-2026-5882 vulnerabilities
Vulnerabilities for packages: eksctl, trivy-operator-fips, kgateway, falcoctl, crossplane-fips, consul-k8s-fips, cert-manager-cmctl-fips, cloudbeat-fips, kubescape-operator-fips, rancher-fleet-fips, argo-cd, ocm-cli, crossplane, manifest-tool, helm, tw, k9s, k8ssandra-client, ocm-cli-fips,...
GO-2026-5880 vulnerabilities
Vulnerabilities for packages: headlamp, helm-operator, helm-set-status, vcluster, opa-envoy, oras, falcoctl, grafana-operator, cilium-cli, zot, steampipe, kyverno, helm-mapkubeapis, chartmuseum, tigera-operator, cert-manager-cmctl, gitness, cluster-api-helm-controller, rancher, rancher-helm,...
GO-2026-4601 vulnerabilities
Vulnerabilities for packages: kubernetes-csi-external-health-monitor, thanos-operator, sbom-convert, net-kourier, victoriametrics-cluster, gitlab-pages, azcopy, cert-exporter, q, terraform-provider-pagerduty, tailscale, nri-nginx, buildah, yunikorn-k8shim, percona-server-mongodb-operator,...
GO-2026-4946 vulnerabilities
Vulnerabilities for packages: goreleaser, kubernetes-csi-external-health-monitor, thanos-operator, docker-credential-acr-env, extism, cloud-provider-azure, nerdctl, sbom-convert, net-kourier, victoriametrics-cluster, docker-credential-gcr, gitlab-pages, nats-server, vexctl, ghaudit, cert-exporter...
SUSE-SU-2026:23052-1 Security update for helm
This update for helm fixes the following issues Update to version 3.21.3. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266598. - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth:...
Security Bulletin: Sterling Order Management System Software, (On prem)
Summary Multiple vulnerabilities were addressed in Sterling Order Management System Software, On prem : 10.0.2607.0-Sterling-SSFF-All-Major-Update-Installer Vulnerability Details CVEID:CVE-2026-48978 DESCRIPTION: oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client...
Security update for trivy (important)
openSUSE Security Update: Security update for trivy Announcement ID: openSUSE-SU-2026:0263-1 Rating: important References: 1266495 1268356 1269269 1269271 1271658 1271670 Cross-References: CVE-2026-39821 CVE-2026-46680 CVE-2026-50151 CVE-2026-54448 CVE-2026-55092 CVE-2026-56852 CVSS scores:...
GO-2026-5882 Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go
Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go...