oras-1.3.3-2.1 on GA media (moderate)

oras-1.3.3-2.1 on GA media Announcement ID: openSUSE-SU-2026:11297-1 Rating: moderate Cross-References: CVE-2026-50163 CVSS scores: CVE-2026-50163 SUSE : 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be...

CVE-2026-50163

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link"victim.secret", "/payload.tar.gz/evilcwdlink" to resolve header.Linkname...

SUSE CVE-2026-50163

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link"victim.secret", "/payload.tar.gz/evilcwdlink" to resolve header.Linkname...

CVE-2026-50163 vulnerabilities

Vulnerabilities for packages: oras-fips, helmfile, zarf, ratify-fips, consul-k8s-fips, jfrog-cli, zarf-fips, ratify, gogatekeeper, consul-k8s, oras...

CVE-2026-50163

creationtimestamp| type| source ---|---|--- 2026-07-01 22:35:07+00:00| published-proof-of-concept| https://github.com/oras-project/oras-go/security/advisories/GHSA-fxhp-mv3v-67qp...