Skip to content
OpenAdvisories

Package · Ubuntu

oras

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.5
    CVE-2026-55588

    ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption

    ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cycli…

    oras-project oras oras oras.land/oras Debian Ubuntu Go