PT-2026-93849

Name of the Vulnerable Software and Affected Versions oras-go versions prior to 2.6.2 Description The parseLink function in registry/remote/utils.go fails to validate the scheme, host, or port of absolute URLs provided in the Link response header from a registry. This allows a malicious registry ...