CVE-2026-50151

CVE-2026-50151 affects oras-go prior to 2.6.1. During monolithic blob uploads, blobStore.completePushAfterInitialPost reuses the initial POST’s Authorization header for a subsequent PUT, while following a registry-controlled Location header. A malicious registry can return a cross-host Location a...