EUVD-2026-66110
GHSA-298f-872v-2rcx
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Client must actively invoke oras against a malicious registry (UI:R, PR:N); sole impact is availability exhaustion with no confidentiality or integrity effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded recursion and memory growth. This affects oras discover, whose recursive traversal is enabled by default because the --depth option defaults to 0 (unlimited), as well as the recursive referrer counting used by the oras backup and oras restore workflows. A cyclic graph can be as simple as A referring to B and B referring back to A. A malicious registry can use this to cause a client-side denial of service, exhausting CPU and memory and hanging automation or CI/CD pipelines that run ORAS against untrusted registry metadata. The vulnerability does not extend to code execution, artifact substitution, or integrity bypass. This issue has been fixed in version 1.3.3.
AnalysisAI
Unbounded recursive referrer traversal in ORAS CLI versions through 1.3.2 allows a malicious OCI registry to trigger client-side denial of service by returning a cyclic referrer graph. Because neither fetchAllReferrers in the discover path nor RecursiveFindReferrers in the backup/restore graph logic tracked visited descriptors, a minimal two-node cycle (A→B→A) is sufficient to exhaust heap memory and CPU on the connecting client. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim actively invoke `oras discover`, `oras backup`, or `oras restore` against an OCI registry endpoint where the attacker controls or can influence the referrer metadata. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 score with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H correctly models a network-reachable, low-complexity denial-of-service that requires the operator to actively run an ORAS command against a malicious registry. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to ORAS CLI version 1.3.3, which is confirmed as the patched release by the GitHub security advisory GHSA-298f-872v-2rcx and the fix commit 440eb65d07a0631f131944d28e7c29d562ec17f3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today