Every CVE Search/ Get API key

CVE-2026-55588

ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption

6.5 MediumFix available

ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded recursion and memory growth. This affects oras discover, whose recursive traversal is enabled by default because the --depth option defaults to 0 (unlimited), as well as the recursive referrer counting used by the oras backup and oras restore workflows. A cyclic graph can be as simple as A referring to B and B referring back to A. A malicious registry can use this to cause a client-side denial of service, exhausting CPU and memory and hanging automation or CI/CD pipelines that run ORAS against untrusted registry metadata. The vulnerability does not extend to code execution, artifact substitution, or integrity bypass. This issue has been fixed in version 1.3.3.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.54%Up 0.2 points since Aug 26, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption

ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded recursion and memory growth. This affects oras discover, whose recursive traversal is enabled by default because the --depth option defaults to 0 (unlimited), as well as the recursive referrer counting used by the oras backup and oras restore workflows. A cyclic graph can be as simple as A referring to B and B referring back to A. A malicious registry can use this to cause a client-side denial of service, exhausting CPU and memory and hanging automation or CI/CD pipelines that run ORAS against untrusted registry metadata. The vulnerability does not extend to code execution, artifact substitution, or integrity bypass. This issue has been fixed in version 1.3.3.

Record
CVE-2026-55588
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-674, CWE-835
Updated
2026-11-02
EUVDEUVD-2026-66110 6.5

ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded recursion and memory growth. This affects oras discover, whose recursive traversal is enabled by default because the --depth option defaults to 0 (unlimited), as well as the recursive referrer counting used by the oras backup and oras restore workflows. A cyclic graph can be as simple as A referring to B and B referring back to A. A malicious registry can use this to cause a client-side denial of service, exhausting CPU and memory and hanging automation or CI/CD pipelines that run ORAS against untrusted registry metadata. The vulnerability does not extend to code execution, artifact substitution, or integrity bypass. This issue has been fixed in version 1.3.3.

Record
EUVD-2026-66110
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-298f-872v-2rcx 2.0

ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption

Summary

A malicious OCI registry can return a cyclic referrer graph (e.g. A -> A or A -> B -> A). The ORAS CLI's recursive referrer traversal does not track visited descriptors, so a cycle causes unbounded recursion and memory growth — a client-side denial of service.

This affects oras discover (recursive referrer traversal) and the recursive referrer counting used by oras backup and oras restore. Because oras discover --depth defaults to 0 (unlimited), discover is affected out of the box.

Note: This advisory covers only the ORAS CLI (oras.land/oras). The related Referrers API pagination loop in the oras-go library is tracked in a separate advisory on the oras-go repository.

Details

In oras discover, recursive referrer traversal follows discovered referrers without maintaining a visited-descriptor set.

Simplified flow:

runDiscover
  -> fetchAllReferrers(root)
     -> registry.Referrers(root)
     -> for each referrer:
          fetchAllReferrers(referrer)

A malicious registry can create cyclic graphs such as:

A -> A

or

A -> B -> A

Because traversal does not track previously visited descriptors, recursion never reaches a terminating condition.

Similarly, the recursive counting logic (graph.RecursiveFindReferrers, used by the backup and restore workflows) accumulates descriptors without cycle detection, causing unbounded memory growth.

PoC

Create valid descriptors where:

referrers(A) = [A]

or:

referrers(A) = [B]
referrers(B) = [A]

Run:

oras discover attacker.local/repo@sha256:<A>

The recursive traversal continues indefinitely, causing unbounded recursion and eventual resource exhaustion.

Impact

A malicious OCI registry can trigger client-side denial of service against ORAS CLI users and automation.

Potential impacts include:

  • Excessive CPU utilization
  • Excessive memory consumption
  • Unbounded recursion
  • Hung CI/CD jobs
  • Stalled automation pipelines
  • Failed backup or discovery operations

The issue does not enable arbitrary code execution, artifact substitution, or integrity bypass, but it can reliably prevent ORAS operations from completing when interacting with malicious registry metadata.

Patch

  • cmd/oras/root/discover.go — fetchAllReferrers threads a visited digest set; an already-traversed descriptor returns immediately, breaking cycles. Behavior is unchanged for valid (acyclic) referrer graphs.
  • internal/graph/graph.go — RecursiveFindReferrers tracks visited descriptors by digest and only recurses into unseen referrers, so traversal terminates on a cyclic graph.
Record
GHSA-298f-872v-2rcx
CVSS 3.1
2.0 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-400, CWE-674, CWE-835
Updated
2026-11-02
NVD 6.5

ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded recursion and memory growth. This affects oras discover, whose recursive traversal is enabled by default because the --depth option defaults to 0 (unlimited), as well as the recursive referrer counting used by the oras backup and oras restore workflows. A cyclic graph can be as simple as A referring to B and B referring back to A. A malicious registry can use this to cause a client-side denial of service, exhausting CPU and memory and hanging automation or CI/CD pipelines that run ORAS against untrusted registry metadata. The vulnerability does not extend to code execution, artifact substitution, or integrity bypass. This issue has been fixed in version 1.3.3.

Record
CVE-2026-55588
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-674, CWE-835
Updated
2026-11-02
OSV 6.5

ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption

ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded recursion and memory growth. This affects oras discover, whose recursive traversal is enabled by default because the --depth option defaults to 0 (unlimited), as well as the recursive referrer counting used by the oras backup and oras restore workflows. A cyclic graph can be as simple as A referring to B and B referring back to A. A malicious registry can use this to cause a client-side denial of service, exhausting CPU and memory and hanging automation or CI/CD pipelines that run ORAS against untrusted registry metadata. The vulnerability does not extend to code execution, artifact substitution, or integrity bypass. This issue has been fixed in version 1.3.3.

Record
CVE-2026-55588
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-674, CWE-835
Updated
2026-11-02
OSVDEBIAN-CVE-2026-55588 6.5

ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded recursion and memory growth. This affects oras discover, whose recursive traversal is enabled by default because the --depth option defaults to 0 (unlimited), as well as the recursive referrer counting used by the oras backup and oras restore workflows. A cyclic graph can be as simple as A referring to B and B referring back to A. A malicious registry can use this to cause a client-side denial of service, exhausting CPU and memory and hanging automation or CI/CD pipelines that run ORAS against untrusted registry metadata. The vulnerability does not extend to code execution, artifact substitution, or integrity bypass. This issue has been fixed in version 1.3.3.

Record
DEBIAN-CVE-2026-55588
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVGHSA-298f-872v-2rcx 2.0

ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption

Summary

A malicious OCI registry can return a cyclic referrer graph (e.g. A -> A or A -> B -> A). The ORAS CLI's recursive referrer traversal does not track visited descriptors, so a cycle causes unbounded recursion and memory growth — a client-side denial of service.

This affects oras discover (recursive referrer traversal) and the recursive referrer counting used by oras backup and oras restore. Because oras discover --depth defaults to 0 (unlimited), discover is affected out of the box.

Note: This advisory covers only the ORAS CLI (oras.land/oras). The related Referrers API pagination loop in the oras-go library is tracked in a separate advisory on the oras-go repository.

Details

In oras discover, recursive referrer traversal follows discovered referrers without maintaining a visited-descriptor set.

Simplified flow:

runDiscover
  -> fetchAllReferrers(root)
     -> registry.Referrers(root)
     -> for each referrer:
          fetchAllReferrers(referrer)

A malicious registry can create cyclic graphs such as:

A -> A

or

A -> B -> A

Because traversal does not track previously visited descriptors, recursion never reaches a terminating condition.

Similarly, the recursive counting logic (graph.RecursiveFindReferrers, used by the backup and restore workflows) accumulates descriptors without cycle detection, causing unbounded memory growth.

PoC

Create valid descriptors where:

referrers(A) = [A]

or:

referrers(A) = [B]
referrers(B) = [A]

Run:

oras discover attacker.local/repo@sha256:<A>

The recursive traversal continues indefinitely, causing unbounded recursion and eventual resource exhaustion.

Impact

A malicious OCI registry can trigger client-side denial of service against ORAS CLI users and automation.

Potential impacts include:

  • Excessive CPU utilization
  • Excessive memory consumption
  • Unbounded recursion
  • Hung CI/CD jobs
  • Stalled automation pipelines
  • Failed backup or discovery operations

The issue does not enable arbitrary code execution, artifact substitution, or integrity bypass, but it can reliably prevent ORAS operations from completing when interacting with malicious registry metadata.

Patch

  • cmd/oras/root/discover.go — fetchAllReferrers threads a visited digest set; an already-traversed descriptor returns immediately, breaking cycles. Behavior is unchanged for valid (acyclic) referrer graphs.
  • internal/graph/graph.go — RecursiveFindReferrers tracks visited descriptors by digest and only recurses into unseen referrers, so traversal terminates on a cyclic graph.
Record
GHSA-298f-872v-2rcx
CVSS 3.1
2.0 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-400, CWE-674, CWE-835
Updated
2026-11-02
OSVUBUNTU-CVE-2026-55588 6.5

ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded recursion and memory growth. This affects oras discover, whose recursive traversal is enabled by default because the --depth option defaults to 0 (unlimited), as well as the recursive referrer counting used by the oras backup and oras restore workflows. A cyclic graph can be as simple as A referring to B and B referring back to A. A malicious registry can use this to cause a client-side denial of service, exhausting CPU and memory and hanging automation or CI/CD pipelines that run ORAS against untrusted registry metadata. The vulnerability does not extend to code execution, artifact substitution, or integrity bypass. This issue has been fixed in version 1.3.3.

Record
UBUNTU-CVE-2026-55588
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGO-2026-6317 No score

ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption in oras.land/oras

ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption in oras.land/oras

Record
GO-2026-6317
Updated
2026-11-02
OSVopenSUSE-SU-2026:21812-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260902T191204 2026-09-02T19:12:04Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-6305 CVE-2026-55834 GHSA-2wvm-8mvp-22qv
  • GO-2026-6306 CVE-2026-55064 GHSA-44v6-7fxq-vgf4
  • GO-2026-6307 CVE-2026-55067 GHSA-569v-q83c-3j3g
  • GO-2026-6308 CVE-2026-55066 GHSA-5pg6-m483-7vrg
  • GO-2026-6309 CVE-2026-54746 GHSA-8x7x-83cf-c3pg
  • GO-2026-6310 CVE-2026-54755 GHSA-cgc5-v3f2-8m2v
  • GO-2026-6311 CVE-2026-54766 GHSA-f27p-pw2p-9pr4
  • GO-2026-6312 CVE-2026-55108 GHSA-fmgp-q6jx-gg3x
  • GO-2026-6313 CVE-2026-55065 GHSA-gg93-x632-9ccv
  • GO-2026-6314 CVE-2026-55569 GHSA-mf5c-hw34-4hpp
  • GO-2026-6315 CVE-2026-54754 GHSA-p7gw-2pcp-5pf8
  • GO-2026-6316 CVE-2026-55068 GHSA-x8mj-6p3q-g5pp
  • GO-2026-6317 CVE-2026-55588 GHSA-298f-872v-2rcx
  • GO-2026-6318 CVE-2026-55621 GHSA-64f3-v33m-w89f
  • GO-2026-6319 CVE-2026-55622 GHSA-c9f5-j9c3-mhrg
  • GO-2026-6320 CVE-2026-55245 GHSA-w98g-5w9p-p3rc
  • GO-2026-6321 CVE-2026-55484 GHSA-hr6j-w4mw-g9mj
  • GO-2026-6322 CVE-2026-55678 GHSA-p378-jp5r-gpgw
  • GO-2026-6323 CVE-2026-55763 GHSA-v358-wf77-39xv
  • GO-2026-6324 CVE-2026-55761 GHSA-x626-fcwx-f5pc
  • GO-2026-6325 CVE-2026-27878 GHSA-6xff-cpcq-vpw2
  • GO-2026-6326 CVE-2026-55784 GHSA-334q-h5g3-fpxv
  • GO-2026-6327 CVE-2026-55874 GHSA-56wq-x3wv-3ff4
  • GO-2026-6328 CVE-2026-55785 GHSA-fp46-6vfw-gc9c
  • GO-2026-6329 CVE-2026-55873 GHSA-hgpf-8634-g44c
  • GO-2026-6330 CVE-2026-55764 GHSA-mrpp-v6pg-p54x
  • GO-2026-6333 CVE-2026-25712 GHSA-37w2-86g3-h4qh
  • GO-2026-6334 CVE-2026-24690 GHSA-47rq-xp99-92mx
  • GO-2026-6335 CVE-2026-27657 GHSA-4c8f-3m6h-m56r
  • GO-2026-6336 CVE-2026-26232 GHSA-5v69-g2m3-3hq3
  • GO-2026-6337 CVE-2026-28705 GHSA-7jvx-g65v-r899
  • GO-2026-6338 CVE-2026-22547 GHSA-922f-hfwp-p56f
  • GO-2026-6339 CVE-2026-20909 GHSA-fhq3-p242-2qpf
  • GO-2026-6340 CVE-2026-25718 GHSA-h697-89cp-24q8
  • GO-2026-6341 CVE-2026-26307 GHSA-h9c5-x7g8-4q7f
  • GO-2026-6342 CVE-2026-26247 GHSA-m5ch-ppfx-xv3v
  • GO-2026-6354 CVE-2026-78662
  • GO-2026-6355 CVE-2026-56855
  • Update to version 0.0.20260828T144745 2026-08-28T14:47:45Z.
  • GO-2026-6303 CVE-2026-56854
Record
openSUSE-SU-2026:21812-1
Updated
2026-11-02
OSVSUSE-SU-2026:23692-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260902T191204 2026-09-02T19:12:04Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-6305 CVE-2026-55834 GHSA-2wvm-8mvp-22qv
  • GO-2026-6306 CVE-2026-55064 GHSA-44v6-7fxq-vgf4
  • GO-2026-6307 CVE-2026-55067 GHSA-569v-q83c-3j3g
  • GO-2026-6308 CVE-2026-55066 GHSA-5pg6-m483-7vrg
  • GO-2026-6309 CVE-2026-54746 GHSA-8x7x-83cf-c3pg
  • GO-2026-6310 CVE-2026-54755 GHSA-cgc5-v3f2-8m2v
  • GO-2026-6311 CVE-2026-54766 GHSA-f27p-pw2p-9pr4
  • GO-2026-6312 CVE-2026-55108 GHSA-fmgp-q6jx-gg3x
  • GO-2026-6313 CVE-2026-55065 GHSA-gg93-x632-9ccv
  • GO-2026-6314 CVE-2026-55569 GHSA-mf5c-hw34-4hpp
  • GO-2026-6315 CVE-2026-54754 GHSA-p7gw-2pcp-5pf8
  • GO-2026-6316 CVE-2026-55068 GHSA-x8mj-6p3q-g5pp
  • GO-2026-6317 CVE-2026-55588 GHSA-298f-872v-2rcx
  • GO-2026-6318 CVE-2026-55621 GHSA-64f3-v33m-w89f
  • GO-2026-6319 CVE-2026-55622 GHSA-c9f5-j9c3-mhrg
  • GO-2026-6320 CVE-2026-55245 GHSA-w98g-5w9p-p3rc
  • GO-2026-6321 CVE-2026-55484 GHSA-hr6j-w4mw-g9mj
  • GO-2026-6322 CVE-2026-55678 GHSA-p378-jp5r-gpgw
  • GO-2026-6323 CVE-2026-55763 GHSA-v358-wf77-39xv
  • GO-2026-6324 CVE-2026-55761 GHSA-x626-fcwx-f5pc
  • GO-2026-6325 CVE-2026-27878 GHSA-6xff-cpcq-vpw2
  • GO-2026-6326 CVE-2026-55784 GHSA-334q-h5g3-fpxv
  • GO-2026-6327 CVE-2026-55874 GHSA-56wq-x3wv-3ff4
  • GO-2026-6328 CVE-2026-55785 GHSA-fp46-6vfw-gc9c
  • GO-2026-6329 CVE-2026-55873 GHSA-hgpf-8634-g44c
  • GO-2026-6330 CVE-2026-55764 GHSA-mrpp-v6pg-p54x
  • GO-2026-6333 CVE-2026-25712 GHSA-37w2-86g3-h4qh
  • GO-2026-6334 CVE-2026-24690 GHSA-47rq-xp99-92mx
  • GO-2026-6335 CVE-2026-27657 GHSA-4c8f-3m6h-m56r
  • GO-2026-6336 CVE-2026-26232 GHSA-5v69-g2m3-3hq3
  • GO-2026-6337 CVE-2026-28705 GHSA-7jvx-g65v-r899
  • GO-2026-6338 CVE-2026-22547 GHSA-922f-hfwp-p56f
  • GO-2026-6339 CVE-2026-20909 GHSA-fhq3-p242-2qpf
  • GO-2026-6340 CVE-2026-25718 GHSA-h697-89cp-24q8
  • GO-2026-6341 CVE-2026-26307 GHSA-h9c5-x7g8-4q7f
  • GO-2026-6342 CVE-2026-26247 GHSA-m5ch-ppfx-xv3v
  • GO-2026-6354 CVE-2026-78662
  • GO-2026-6355 CVE-2026-56855
  • Update to version 0.0.20260828T144745 2026-08-28T14:47:45Z.
  • GO-2026-6303 CVE-2026-56854
Record
SUSE-SU-2026:23692-1
Updated
2026-11-02
OSVSUSE-SU-2026:23712-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260902T191204 2026-09-02T19:12:04Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-6305 CVE-2026-55834 GHSA-2wvm-8mvp-22qv
  • GO-2026-6306 CVE-2026-55064 GHSA-44v6-7fxq-vgf4
  • GO-2026-6307 CVE-2026-55067 GHSA-569v-q83c-3j3g
  • GO-2026-6308 CVE-2026-55066 GHSA-5pg6-m483-7vrg
  • GO-2026-6309 CVE-2026-54746 GHSA-8x7x-83cf-c3pg
  • GO-2026-6310 CVE-2026-54755 GHSA-cgc5-v3f2-8m2v
  • GO-2026-6311 CVE-2026-54766 GHSA-f27p-pw2p-9pr4
  • GO-2026-6312 CVE-2026-55108 GHSA-fmgp-q6jx-gg3x
  • GO-2026-6313 CVE-2026-55065 GHSA-gg93-x632-9ccv
  • GO-2026-6314 CVE-2026-55569 GHSA-mf5c-hw34-4hpp
  • GO-2026-6315 CVE-2026-54754 GHSA-p7gw-2pcp-5pf8
  • GO-2026-6316 CVE-2026-55068 GHSA-x8mj-6p3q-g5pp
  • GO-2026-6317 CVE-2026-55588 GHSA-298f-872v-2rcx
  • GO-2026-6318 CVE-2026-55621 GHSA-64f3-v33m-w89f
  • GO-2026-6319 CVE-2026-55622 GHSA-c9f5-j9c3-mhrg
  • GO-2026-6320 CVE-2026-55245 GHSA-w98g-5w9p-p3rc
  • GO-2026-6321 CVE-2026-55484 GHSA-hr6j-w4mw-g9mj
  • GO-2026-6322 CVE-2026-55678 GHSA-p378-jp5r-gpgw
  • GO-2026-6323 CVE-2026-55763 GHSA-v358-wf77-39xv
  • GO-2026-6324 CVE-2026-55761 GHSA-x626-fcwx-f5pc
  • GO-2026-6325 CVE-2026-27878 GHSA-6xff-cpcq-vpw2
  • GO-2026-6326 CVE-2026-55784 GHSA-334q-h5g3-fpxv
  • GO-2026-6327 CVE-2026-55874 GHSA-56wq-x3wv-3ff4
  • GO-2026-6328 CVE-2026-55785 GHSA-fp46-6vfw-gc9c
  • GO-2026-6329 CVE-2026-55873 GHSA-hgpf-8634-g44c
  • GO-2026-6330 CVE-2026-55764 GHSA-mrpp-v6pg-p54x
  • GO-2026-6333 CVE-2026-25712 GHSA-37w2-86g3-h4qh
  • GO-2026-6334 CVE-2026-24690 GHSA-47rq-xp99-92mx
  • GO-2026-6335 CVE-2026-27657 GHSA-4c8f-3m6h-m56r
  • GO-2026-6336 CVE-2026-26232 GHSA-5v69-g2m3-3hq3
  • GO-2026-6337 CVE-2026-28705 GHSA-7jvx-g65v-r899
  • GO-2026-6338 CVE-2026-22547 GHSA-922f-hfwp-p56f
  • GO-2026-6339 CVE-2026-20909 GHSA-fhq3-p242-2qpf
  • GO-2026-6340 CVE-2026-25718 GHSA-h697-89cp-24q8
  • GO-2026-6341 CVE-2026-26307 GHSA-h9c5-x7g8-4q7f
  • GO-2026-6342 CVE-2026-26247 GHSA-m5ch-ppfx-xv3v
  • GO-2026-6354 CVE-2026-78662
  • GO-2026-6355 CVE-2026-56855
  • Update to version 0.0.20260828T144745 2026-08-28T14:47:45Z.
  • GO-2026-6303 CVE-2026-56854
Record
SUSE-SU-2026:23712-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
oras.land/oras
Go
 before 1.3.3
1.3.3
oras
Debian:13
 All versions, plus listed versions
1.2.0-11.2.3-11.3.0-11.3.3-1
 None known
oras
Debian:14
 before 1.3.3-1, plus listed versions
1.2.0-11.2.3-11.3.0-1
1.3.3-1
govulncheck-vulndb
SUSE:Linux Enterprise Server 16.0
From an advisory covering 39 CVEs
 before 0.0.20260902T191204-160000.1.1
0.0.20260902T191204-160000.1.1
govulncheck-vulndb
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 39 CVEs
 before 0.0.20260902T191204-160000.1.1
0.0.20260902T191204-160000.1.1
oras
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
1.2.0-11.3.0-11.3.0-1ubuntu0.26.04.1~esm1
 None known
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 39 CVEs
 before 0.0.20260902T191204-160000.1.1
0.0.20260902T191204-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-55588 is a medium vulnerability (CVSS 6.5) in Deislabs Oras, published August 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. Fixed in oras.land/oras 1.3.3.

References

Show 44 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open