CVE-2026-85732

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then...

CVE-2026-85731

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets...

CVE-2026-85731

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2 , the content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true is vulnerable to an arbitrary file-write outside the store's working directory. The root cause lies in the pushDir path: extractTarDire...

CVE-2026-85731 oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets...

EUVD-2026-80873

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets...

CVE-2026-85732

oras-go (a Go library for managing OCI artifacts) prior to 2.6.2 contains a blind SSRF vulnerability in the parseLink function within registry/remote/utils.go. The function accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port, causin...

CVE-2026-85732 oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then...

EUVD-2026-80871

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then...

CVE-2026-85732 oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then...

openSUSE 16: helm / helm-bash-completion / helm-fish-completion / etc (openSUSE-SU-2026:21809-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21809-1 advisory. Update to version 3.21.1: - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST...

EUVD-2026-66110

ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption...

GHSA-298F-872V-2RCX ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption

Summary A malicious OCI registry can return a cyclic referrer graph e.g. A - A or A - B - A. The ORAS CLI's recursive referrer traversal does not track visited descriptors, so a cycle causes unbounded recursion and memory growth — a client-side denial of service. This affects oras discover...

Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

Summary Multiple vulnerabilities were addressed in IBM Observability with Instana within Instana Agent container image build 1.0.323 Vulnerability Details CVEID:CVE-2026-50163 DESCRIPTION: oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in...

CVE-2026-55588

A flaw was found in ORAS OCI Registry As Storage CLI. A remote attacker, by operating a malicious OCI Open Container Initiative registry that returns a cyclic referrer graph, could cause unbounded recursion and memory growth in the client. This vulnerability leads to a client-side Denial of Servi...

Linux Distros Unpatched Vulnerability : CVE-2026-55588

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ORAS OCI Registry As Storage is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referr...

DEBIAN-CVE-2026-55588

ORAS OCI Registry As Storage is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded...

CVE-2026-55588

ORAS OCI Registry As Storage is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded...

CVE-2026-55588

ORAS OCI Registry As Storage is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded...

UBUNTU-CVE-2026-55588

ORAS OCI Registry As Storage is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded...

CVE-2026-55588

ORAS CLI (OCI Registry As Storage) versions up to and including 1.3.2 contain a client-side denial-of-service vulnerability in the recursive referrer traversal. The traversal does not track visited descriptors, so a malicious OCI registry returning a cyclic referrer graph (e.g., A→B→A) triggers u...