Every CVE Search/ Get API key

CVE-2026-85732

oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

4.7 MediumFix available

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then issue a GET request to the attacker-selected URL from the victim's network, allowing blind server-side request forgery against internal services. The response body is not returned to the attacker, but timing and error differences can reveal service reachability, and credentials may be attached when the credential store has an entry for the target host. Exploitation requires a victim to perform a pagination-based listing operation against a malicious registry. The maintainer identifies this report as a duplicate of GHSA-3hr5-mjrr-hfjh and states that remediation is consolidated in that earlier advisory. The consolidated issue is fixed in version 2.6.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.38%Unchanged since Sep 17, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.7

oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then issue a GET request to the attacker-selected URL from the victim's network, allowing blind server-side request forgery against internal services. The response body is not returned to the attacker, but timing and error differences can reveal service reachability, and credentials may be attached when the credential store has an entry for the target host. Exploitation requires a victim to perform a pagination-based listing operation against a malicious registry. The maintainer identifies this report as a duplicate of GHSA-3hr5-mjrr-hfjh and states that remediation is consolidated in that earlier advisory. The consolidated issue is fixed in version 2.6.2.

Record
CVE-2026-85732
CVSS 3.1
4.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
EUVDEUVD-2026-80871 4.7

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then issue a GET request to the attacker-selected URL from the victim's network, allowing blind server-side request forgery against internal services. The response body is not returned to the attacker, but timing and error differences can reveal service reachability, and credentials may be attached when the credential store has an entry for the target host. Exploitation requires a victim to perform a pagination-based listing operation against a malicious registry. The maintainer identifies this report as a duplicate of GHSA-3hr5-mjrr-hfjh and states that remediation is consolidated in that earlier advisory. The consolidated issue is fixed in version 2.6.2.

Record
EUVD-2026-80871
CVSS 3.1
4.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-h7vf-4x9w-h99v 4.7

oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

Summary

oras-go's pagination helper parseLink() in registry/remote/utils.go follows the Link response header from a registry without validating the URL's host or scheme. When a malicious registry returns a Link header containing an absolute URL pointing to an arbitrary host (e.g., a cloud metadata endpoint), the client makes GET requests to that host from the victim's network.

This affects all pagination-based listing operations: Tags, Referrers, and Repositories (catalog).

Root Cause

parseLink() at registry/remote/utils.go:54 calls resp.Request.URL.Parse(link) which, for absolute URLs, returns the absolute URL unchanged. The result is passed directly to the next pagination loop iteration where http.NewRequestWithContext() creates a GET request to the attacker-specified URL. No host comparison, scheme validation, or IP filtering exists between parseLink output and the HTTP request.

Affected Code Paths

  • registry/remote/repository.go:Tags() calls parseLink() for next page URL
  • registry/remote/repository.go:Referrers() calls parseLink() for next page URL
  • registry/remote/registry.go:Repositories() calls parseLink() for next page URL

Impact

Blind SSRF from the victim's network. A malicious registry operator can force any oras-go client that lists tags, referrers, or repositories to issue GET requests to arbitrary internal endpoints:

  • Cloud instance metadata endpoints for service discovery and IAM role enumeration
  • Internal HTTP services for port scanning and triggering side effects
  • If the victim's credential store maps credentials for the SSRF target host, those credentials are attached to the request (auth.Client looks up creds by request host)

The attacker cannot read the response body (it's parsed as JSON and fails), making this a blind SSRF. However, timing and error differences can confirm internal service existence.

Attack Chain

  1. Victim calls repo.Tags() / repo.Referrers() / registry.Repositories() against attacker-controlled registry
  2. Registry returns a valid first page + malicious Link header pointing to an internal endpoint
  3. parseLink() extracts the absolute URL with zero validation
  4. Pagination loop makes GET request to the internal endpoint from victim's network

PoC

<details> <summary>Expand PoC</summary> 

// Malicious registry handler for /v2/repo/tags/list:
func handler(w http.ResponseWriter, r *http.Request) {
    // Link header points to cloud metadata or internal service
    w.Header().Set("Link", `<http://internal-service:8080/admin>; rel="next"`)
    w.Header().Set("Content-Type", "application/json")
    json.NewEncoder(w).Encode(map[string][]string{"tags": {"v1"}})
}

// Victim code:
repo, _ := remote.NewRepository("attacker-registry.io/repo")
repo.Tags(ctx, "", func(tags []string) error { return nil })
// Result: GET http://internal-service:8080/admin is made from victim's network

</details>

Suggested Fix

Validate that the URL returned by parseLink() has the same host and scheme as the original request before using it for the next pagination request. Reject cross-host or scheme-downgrade URLs.

Reported by zx (Jace)

Record
GHSA-h7vf-4x9w-h99v
CVSS 3.1
4.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
NVD 4.7

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then issue a GET request to the attacker-selected URL from the victim's network, allowing blind server-side request forgery against internal services. The response body is not returned to the attacker, but timing and error differences can reveal service reachability, and credentials may be attached when the credential store has an entry for the target host. Exploitation requires a victim to perform a pagination-based listing operation against a malicious registry. The maintainer identifies this report as a duplicate of GHSA-3hr5-mjrr-hfjh and states that remediation is consolidated in that earlier advisory. The consolidated issue is fixed in version 2.6.2.

Record
CVE-2026-85732
CVSS 3.1
4.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
OSV 4.7

oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then issue a GET request to the attacker-selected URL from the victim's network, allowing blind server-side request forgery against internal services. The response body is not returned to the attacker, but timing and error differences can reveal service reachability, and credentials may be attached when the credential store has an entry for the target host. Exploitation requires a victim to perform a pagination-based listing operation against a malicious registry. The maintainer identifies this report as a duplicate of GHSA-3hr5-mjrr-hfjh and states that remediation is consolidated in that earlier advisory. The consolidated issue is fixed in version 2.6.2.

Record
CVE-2026-85732
CVSS 3.1
4.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Weakness
CWE-918
Updated
2026-11-05
OSVDEBIAN-CVE-2026-85732 4.7

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then issue a GET request to the attacker-selected URL from the victim's network, allowing blind server-side request forgery against internal services. The response body is not returned to the attacker, but timing and error differences can reveal service reachability, and credentials may be attached when the credential store has an entry for the target host. Exploitation requires a victim to perform a pagination-based listing operation against a malicious registry. The maintainer identifies this report as a duplicate of GHSA-3hr5-mjrr-hfjh and states that remediation is consolidated in that earlier advisory. The consolidated issue is fixed in version 2.6.2.

Record
DEBIAN-CVE-2026-85732
CVSS 3.1
4.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Updated
2026-11-02
Show 14 moreShow less
OSVGHSA-h7vf-4x9w-h99v 4.7

oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

Summary

oras-go's pagination helper parseLink() in registry/remote/utils.go follows the Link response header from a registry without validating the URL's host or scheme. When a malicious registry returns a Link header containing an absolute URL pointing to an arbitrary host (e.g., a cloud metadata endpoint), the client makes GET requests to that host from the victim's network.

This affects all pagination-based listing operations: Tags, Referrers, and Repositories (catalog).

Root Cause

parseLink() at registry/remote/utils.go:54 calls resp.Request.URL.Parse(link) which, for absolute URLs, returns the absolute URL unchanged. The result is passed directly to the next pagination loop iteration where http.NewRequestWithContext() creates a GET request to the attacker-specified URL. No host comparison, scheme validation, or IP filtering exists between parseLink output and the HTTP request.

Affected Code Paths

  • registry/remote/repository.go:Tags() calls parseLink() for next page URL
  • registry/remote/repository.go:Referrers() calls parseLink() for next page URL
  • registry/remote/registry.go:Repositories() calls parseLink() for next page URL

Impact

Blind SSRF from the victim's network. A malicious registry operator can force any oras-go client that lists tags, referrers, or repositories to issue GET requests to arbitrary internal endpoints:

  • Cloud instance metadata endpoints for service discovery and IAM role enumeration
  • Internal HTTP services for port scanning and triggering side effects
  • If the victim's credential store maps credentials for the SSRF target host, those credentials are attached to the request (auth.Client looks up creds by request host)

The attacker cannot read the response body (it's parsed as JSON and fails), making this a blind SSRF. However, timing and error differences can confirm internal service existence.

Attack Chain

  1. Victim calls repo.Tags() / repo.Referrers() / registry.Repositories() against attacker-controlled registry
  2. Registry returns a valid first page + malicious Link header pointing to an internal endpoint
  3. parseLink() extracts the absolute URL with zero validation
  4. Pagination loop makes GET request to the internal endpoint from victim's network

PoC

<details> <summary>Expand PoC</summary> 

// Malicious registry handler for /v2/repo/tags/list:
func handler(w http.ResponseWriter, r *http.Request) {
    // Link header points to cloud metadata or internal service
    w.Header().Set("Link", `<http://internal-service:8080/admin>; rel="next"`)
    w.Header().Set("Content-Type", "application/json")
    json.NewEncoder(w).Encode(map[string][]string{"tags": {"v1"}})
}

// Victim code:
repo, _ := remote.NewRepository("attacker-registry.io/repo")
repo.Tags(ctx, "", func(tags []string) error { return nil })
// Result: GET http://internal-service:8080/admin is made from victim's network

</details>

Suggested Fix

Validate that the URL returned by parseLink() has the same host and scheme as the original request before using it for the next pagination request. Reject cross-host or scheme-downgrade URLs.

Reported by zx (Jace)

Record
GHSA-h7vf-4x9w-h99v
CVSS 3.1
4.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
OSVUBUNTU-CVE-2026-85732 4.7

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then issue a GET request to the attacker-selected URL from the victim's network, allowing blind server-side request forgery against internal services. The response body is not returned to the attacker, but timing and error differences can reveal service reachability, and credentials may be attached when the credential store has an entry for the target host. Exploitation requires a victim to perform a pagination-based listing operation against a malicious registry. The maintainer identifies this report as a duplicate of GHSA-3hr5-mjrr-hfjh and states that remediation is consolidated in that earlier advisory. The consolidated issue is fixed in version 2.6.2.

Record
UBUNTU-CVE-2026-85732
CVSS 3.1
4.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Updated
2026-11-02
OSVGO-2026-6497 No score

Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go

Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go

Record
GO-2026-6497
Updated
2026-11-02
OSVopenSUSE-SU-2026:11832-1 No score

helm3-3.22.0-1.1 on GA media

These are all security issues fixed in the helm3-3.22.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11832-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:11848-1 No score

helm-4.3.0-2.1 on GA media

These are all security issues fixed in the helm-4.3.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11848-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21983-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
  • CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939).
  • CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935).
  • CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
  • CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
  • CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).
  • CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).
  • CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
  • CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
  • CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).
  • CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
  • CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
  • CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).
Record
openSUSE-SU-2026:21983-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22057-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283642).
  • CVE-2026-81870: OpenTelemetry-Go: Information disclosure via exporter (bsc#1284104).
  • CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
Record
openSUSE-SU-2026:22057-1
Updated
2026-11-02
OSVSUSE-SU-2026:23973-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
  • CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939).
  • CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935).
  • CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
  • CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
  • CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).
  • CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).
  • CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
  • CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
  • CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).
  • CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
  • CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
  • CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).
Record
SUSE-SU-2026:23973-1
Updated
2026-11-02
OSVSUSE-SU-2026:23984-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
  • CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939).
  • CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935).
  • CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
  • CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
  • CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).
  • CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).
  • CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
  • CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
  • CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).
  • CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
  • CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
  • CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).
Record
SUSE-SU-2026:23984-1
Updated
2026-11-02
OSVSUSE-SU-2026:24120-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283642).
  • CVE-2026-81870: OpenTelemetry-Go: Information disclosure via exporter (bsc#1284104).
  • CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
Record
SUSE-SU-2026:24120-1
Updated
2026-11-02
OSVSUSE-SU-2026:24247-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283642).
  • CVE-2026-81870: OpenTelemetry-Go: Information disclosure via exporter (bsc#1284104).
  • CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
Record
SUSE-SU-2026:24247-1
Updated
2026-11-02
OSVSUSE-SU-2026:24282-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
  • CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939).
  • CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935).
  • CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
  • CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
  • CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1281426).
  • CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
  • CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
  • CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283642).
  • CVE-2026-81870: OpenTelemetry-Go: Information disclosure via exporter (bsc#1284104).
  • CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
  • CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
  • CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).

Changes for helm:

  • update to 4.3.0:
  • feat: Add duration functions
  • feat(engine): add debug logging when lookup returns empty
  • feat: add ownership verification before deleting resources
  • feat: honor SOURCE_DATE_EPOCH for chart archives
  • feat(rollback): add --description flag to provide rollback reason
  • fix (internal/plugin): remove zero-width spaces from plugin name comment
  • fix(loader): do not drop values files ending at a 4096-byte boundary
  • fix(chart): normalize StampModTimes timestamp to UTC/truncate
  • Chart.lock reproducibility test
  • fix(provenance): support GnuPG keybox (pubring.kbx) keyrings
  • fix(template): regression - route registry messages to stderr in template and show
  • refactor: lower resync period from one hour to 3 minutes
  • perf: enable concurrent status computation to prevent multi-minute delays
  • fix: Improve error reporting for helm template --debug with --show-only- #31185
  • fix: fetch logs from all containers in test pods- #32099
  • fix(provenance): check error return in Digest and encodeRelease- #32136
  • fix panic on repeated IsReachable calls- #32184
  • fix: set [pull,push] scope when helm push to a registry(use token auth) - v4- #31211
  • Fix missing conflict retry with server-side apply- #32088
  • Properly format the extra field in gzipped…
Record
SUSE-SU-2026:24282-1
Updated
2026-11-02
OSVSUSE-SU-2026:4417-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (bsc#1281104).
  • CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).

Changes for helm:

  • Update to version 3.22.0:
  • chore(deps): bump the k8s-io group across 1 directory with 6 updates
  • bump version to 3.22 (#32606)
  • fix: set [pull,push] scope when helm push to a registry(use token auth) (backport) (#32362)
  • chore(deps): bump the k8s-io group with 7 updates (#32573)
  • chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#32563)
  • chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#32554)
  • chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#32542)
  • [dev-v3 backport] deps: bump google.golang.org/[email protected] for GO-2026-6061 (#32536)
  • fix: bump go.opentelemetry.io/[email protected] for GO-2026-5158 (#32535)
  • chore(deps): bump github.com/santhosh-tekuri/jsonschema/v6
  • fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932
  • chore(deps): bump the k8s-io group with 7 updates
  • chore(deps): bump github/codeql-action/upload-sarif (#32449)
  • chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.2
  • chore(deps): bump github/codeql-action/autobuild from 4.37.1 to 4.37.2
  • chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.2
  • chore(deps): bump github/codeql-action/autobuild from 4.37.0 to 4.37.1 (#32381)
  • chore(deps): bump github/codeql-action/upload-sarif (#32382)
  • ci: auto-label PRs targeting dev-v3 (#32340)
  • chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (#32331)
  • chore(deps): bump github.com/mattn/go-shellwords from 1.0.13 to 1.0.14 (#32332)
  • chore(deps): bump github/codeql-action/analyze from 3.26.6 to 4.37.0 (#32357)
  • chore(deps): bump github/codeql-action/upload-sarif (#32360)
  • chore(deps): bump github/codeql-action/init from 3.26.6 to 4.37.0 (#32359)
  • chore(deps): bump golang/govulncheck-action from 1.0.4 to 1.1.0 (#32356)
  • chore(deps): bump golangci/golangci-lint-action from 6.1.1 to 9.3.0 (#32354)
  • chore(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.3 (#32353)
  • chore(deps): bump golang.org/x/text from 0.38.0 to 0.40.0 (#32310)
  • chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 (#32308)
  • chore(deps): bump golang.org/x/term from 0.44.0 to 0.45.0 (#32306)
  • fix(engine): prevent Files.Lines panic on empty file
  • fix: drop containerd v1 dep to resolve govulncheck CVEs
  • chore(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33
  • chore(deps): bump github.com/cyphar/filepath-securejoin
  • chore(deps): bump the k8s-io group with 2 updates
  • chore(deps): bump the k8s-io group across 1 directory with 2 updates
  • fix(registry): keep credentials on plain-HTTP fallback with oras-go v2.6.1
  • chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1
  • chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0
  • chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0
  • chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0
  • ci: bump golangci-lint to v2.11.3 for go 1.26
  • chore(deps): bump github.com/lib/pq from 1.11.2 to 1.12.3
  • chore(deps): bump github.com/distribution/distribution/v3
  • chore(deps): bump github.com/containerd/containerd from 1.7.30 to 1.7.32
  • chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0
  • chore(deps): bump github.com/mattn/go-shellwords from 1.0.12 to 1.0.13
  • chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0
  • fix(deps): bump golang.org/x/net to v0.55.0 to address GO-2026-5026
  • chore(deps): bump k8s.io/klog/v2 from 2.130.1 to 2.140.0
  • chore(deps): bump golang.org/x/text from 0.35.0 to 0.37.0
  • [v3] Bump to version v3.21 (#32103)
  • [v3 backport] Fix rollback for missing resources
  • fix(action): avoid nil REST…
Record
SUSE-SU-2026:4417-1
Updated
2026-11-02
OSVSUSE-SU-2026:5119-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283642).
  • CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes (bsc#1285273).
  • CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
  • CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
  • CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).

Changes for helm:

  • Update to version 3.22.1
Record
SUSE-SU-2026:5119-1
Updated
2026-11-05

Affected products

Affected packages

Affected packages
PackageAffectedFixed
oras.land/oras-go/v2
Go
 through 2.6.1
2.6.2
golang-oras-oras-go
Debian:12
 All versions, plus listed versions
1.1.1-12.5.0-12.6.0-12.6.2-12.6.2-2
 None known
golang-oras-oras-go
Debian:13
 All versions, plus listed versions
2.5.0-12.6.0-12.6.2-12.6.2-2
 None known
golang-oras-oras-go
Debian:14
 before 2.6.2-1, plus listed versions
2.5.0-12.6.0-1
2.6.2-1
oras.land/oras-go/v2
Go
 before 2.6.2
2.6.2
helm
SUSE:Linux Micro 6.2
From an advisory covering 18 CVEs
 before 4.3.0-160000.1.1
4.3.0-160000.1.1
helm
SUSE:Linux Enterprise Server 16.0
From an advisory covering 18 CVEs
 before 4.3.0-160000.1.1
4.3.0-160000.1.1
helm
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 18 CVEs
 before 4.3.0-160000.1.1
4.3.0-160000.1.1
helm
SUSE:Linux Micro 6.2
From an advisory covering 3 CVEs
 before 4.3.0-160000.2.1
4.3.0-160000.2.1
helm
SUSE:Linux Enterprise Server 16.0
From an advisory covering 3 CVEs
 before 4.3.0-160000.2.1
4.3.0-160000.2.1
Show 34 moreShow less
Affected packages
PackageAffectedFixed
helm
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 3 CVEs
 before 4.3.0-160000.2.1
4.3.0-160000.2.1
helm
SUSE:Linux Micro 6.1
From an advisory covering 20 CVEs
 before 4.3.0-slfo.1.1_1.1
4.3.0-slfo.1.1_1.1
helm
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 2 CVEs
 before 3.22.0-150000.1.99.1
3.22.0-150000.1.99.1
helm
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 2 CVEs
 before 3.22.0-150000.1.99.1
3.22.0-150000.1.99.1
helm
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 2 CVEs
 before 3.22.0-150000.1.99.1
3.22.0-150000.1.99.1
helm
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 2 CVEs
 before 3.22.0-150000.1.99.1
3.22.0-150000.1.99.1
helm
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 3.22.0-150000.1.99.1
3.22.0-150000.1.99.1
helm
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 2 CVEs
 before 3.22.0-150000.1.99.1
3.22.0-150000.1.99.1
helm
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 3.22.0-150000.1.99.1
3.22.0-150000.1.99.1
helm
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 3.22.0-150000.1.99.1
3.22.0-150000.1.99.1
helm
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 3.22.0-150000.1.99.1
3.22.0-150000.1.99.1
helm
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 2 CVEs
 before 3.22.0-150000.1.99.1
3.22.0-150000.1.99.1
helm
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 2 CVEs
 before 3.22.0-150000.1.99.1
3.22.0-150000.1.99.1
helm
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 2 CVEs
 before 3.22.0-150000.1.99.1
3.22.0-150000.1.99.1
helm
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 2 CVEs
 before 3.22.0-150000.1.99.1
3.22.0-150000.1.99.1
helm
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 5 CVEs
 before 3.22.1-150000.1.104.1
3.22.1-150000.1.104.1
helm
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 5 CVEs
 before 3.22.1-150000.1.104.1
3.22.1-150000.1.104.1
helm
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 5 CVEs
 before 3.22.1-150000.1.104.1
3.22.1-150000.1.104.1
helm
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 5 CVEs
 before 3.22.1-150000.1.104.1
3.22.1-150000.1.104.1
helm
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 5 CVEs
 before 3.22.1-150000.1.104.1
3.22.1-150000.1.104.1
helm
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 5 CVEs
 before 3.22.1-150000.1.104.1
3.22.1-150000.1.104.1
helm
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 5 CVEs
 before 3.22.1-150000.1.104.1
3.22.1-150000.1.104.1
helm
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 5 CVEs
 before 3.22.1-150000.1.104.1
3.22.1-150000.1.104.1
helm
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 5 CVEs
 before 3.22.1-150000.1.104.1
3.22.1-150000.1.104.1
helm
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 5 CVEs
 before 3.22.1-150000.1.104.1
3.22.1-150000.1.104.1
helm
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 5 CVEs
 before 3.22.1-150000.1.104.1
3.22.1-150000.1.104.1
helm
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 5 CVEs
 before 3.22.1-150000.1.104.1
3.22.1-150000.1.104.1
helm
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 5 CVEs
 before 3.22.1-150000.1.104.1
3.22.1-150000.1.104.1
golang-oras-oras-go
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.1.1-1ubuntu1
 None known
golang-oras-oras-go
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.5.0-12.6.0-1
 None known
helm3
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 3.22.0-1.1
3.22.0-1.1
helm
openSUSE:Tumbleweed
 before 4.3.0-2.1
4.3.0-2.1
helm
openSUSE:Leap 16.0
From an advisory covering 18 CVEs
 before 4.3.0-160000.1.1
4.3.0-160000.1.1
helm
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 4.3.0-160000.2.1
4.3.0-160000.2.1

History

History
RecordedChangedSources
affected
affected, aliases, referencesOSV
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-85732 is a medium vulnerability (CVSS 4.7) in Oras-project Oras-go, published September 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in oras.land/oras-go/v2 2.6.2.

References

Show 54 moreShow less
This page doesn't list everything

Left out here: the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open