CVE-2026-55588

Received Received - Intake

Recursive Referrer Traversal DoS in ORAS CLI

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description

ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded recursion and memory growth. This affects oras discover, whose recursive traversal is enabled by default because the --depth option defaults to 0 (unlimited), as well as the recursive referrer counting used by the oras backup and oras restore workflows. A cyclic graph can be as simple as A referring to B and B referring back to A. A malicious registry can use this to cause a client-side denial of service, exhausting CPU and memory and hanging automation or CI/CD pipelines that run ORAS against untrusted registry metadata. The vulnerability does not extend to code execution, artifact substitution, or integrity bypass. This issue has been fixed in version 1.3.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-25

Generated

2026-08-26

AI Q&A

2026-08-26

EPSS Evaluated

N/A

NVD

CVE-2026-55588

Affected Vendors & Products

Vendor	Product	Version / Range
oras	oras_cli	to 1.3.2 (inc)
oras	oras_cli	1.3.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

ORAS is a tool for managing artifacts in OCI registries. This vulnerability involves a flaw in how ORAS handles recursive referrer traversal. When a malicious OCI registry returns a cyclic referrer graph (e.g., A refers to B and B refers back to A), ORAS enters unbounded recursion, consuming excessive CPU and memory. This causes a denial of service by hanging automation or CI/CD pipelines.

Detection Guidance

To detect this vulnerability, check the installed ORAS CLI version using 'oras version'. If it is 1.3.2 or earlier, the system is vulnerable. No specific commands are provided to detect cyclic referrer graphs, but monitoring for unusual memory or CPU usage during ORAS operations may indicate exploitation.

Impact Analysis

If you use ORAS CLI versions up to 1.3.2, a malicious registry could exhaust your system's resources, causing crashes or freezing of applications. Automation tools or CI/CD pipelines relying on ORAS may hang, disrupting workflows. The impact is limited to resource exhaustion and does not allow code execution or data tampering.

Compliance Impact

This vulnerability could lead to service disruptions, potentially violating availability requirements in GDPR or HIPAA. Downtime from resource exhaustion may impact data processing or system integrity, though it does not directly cause data breaches or unauthorized access.

Mitigation Strategies

Upgrade ORAS CLI to version 1.3.3 or later immediately. Avoid using ORAS with untrusted registries until patched. Disable recursive traversal by default using --depth=1 unless explicitly required.

Hi! I’m here to help you understand CVE-2026-55588. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70