oras.land/oras-go/v2
Activity
- Latest release
- 6d ago
- Total releases
- 23
- Cadence
- ~36 days
- Last 12 months
- 5
Details
- First release
- Jun 24, 2022
| Version | Released | |
|---|---|---|
v2.7.0
minor
|
v2.7.0
minor
Dependencies (3)
|
|
v2.6.4
patch
|
v2.6.4
patch
Dependencies (3)
|
|
v2.6.3
patch
|
v2.6.3
patch
Dependencies (3)
|
|
v2.6.2
patch
|
v2.6.2
patch
Dependencies (3)
|
|
v2.6.1
patch
3 CVEs
CVE-2026-85731
GO-2026-6499
GHSA-m37j-52j7-pjw7
Oct 01, 2026
Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-85732
GO-2026-6497
GHSA-h7vf-4x9w-h99v
Oct 01, 2026
Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-50163
GO-2026-5880
GHSA-fxhp-mv3v-67qp
Jul 24, 2026
Hardlink path traversal during tar extraction in oras.land/oras-go Hardlink path traversal during tar extraction in oras.land/oras-go Fixed in
2.6.2
References Updated Jul 29, 2026 · Source: OSV.dev |
v2.6.1
patch
Dependencies (3)
|
|
v2.6.0
minor
7 CVEs
CVE-2026-85731
GO-2026-6499
GHSA-m37j-52j7-pjw7
Oct 01, 2026
Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-85732
GO-2026-6497
GHSA-h7vf-4x9w-h99v
Oct 01, 2026
Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-50162
GO-2026-5879
GHSA-8xwf-rjm4-xvhv
Jul 24, 2026
Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-50163
GO-2026-5880
GHSA-fxhp-mv3v-67qp
Jul 24, 2026
Hardlink path traversal during tar extraction in oras.land/oras-go Hardlink path traversal during tar extraction in oras.land/oras-go Fixed in
2.6.2
References Updated Jul 29, 2026 · Source: OSV.dev
CVE-2026-50151
GO-2026-5882
GHSA-jxpm-75mh-9fp7
Jul 24, 2026
Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
GO-2026-5884
GHSA-vh4v-2xq2-g5cg
Jul 24, 2026
ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-48978
GO-2026-5885
GHSA-xf85-363p-868w
Jul 24, 2026
Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Fixed in
2.6.1
References Updated Aug 25, 2026 · Source: OSV.dev |
v2.6.0
minor
Dependencies (3)
|
|
v2.5.0
minor
7 CVEs
CVE-2026-85731
GO-2026-6499
GHSA-m37j-52j7-pjw7
Oct 01, 2026
Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-85732
GO-2026-6497
GHSA-h7vf-4x9w-h99v
Oct 01, 2026
Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-50162
GO-2026-5879
GHSA-8xwf-rjm4-xvhv
Jul 24, 2026
Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-50163
GO-2026-5880
GHSA-fxhp-mv3v-67qp
Jul 24, 2026
Hardlink path traversal during tar extraction in oras.land/oras-go Hardlink path traversal during tar extraction in oras.land/oras-go Fixed in
2.6.2
References Updated Jul 29, 2026 · Source: OSV.dev
CVE-2026-50151
GO-2026-5882
GHSA-jxpm-75mh-9fp7
Jul 24, 2026
Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
GO-2026-5884
GHSA-vh4v-2xq2-g5cg
Jul 24, 2026
ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-48978
GO-2026-5885
GHSA-xf85-363p-868w
Jul 24, 2026
Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Fixed in
2.6.1
References Updated Aug 25, 2026 · Source: OSV.dev |
v2.5.0
minor
Dependencies (3)
|
|
v2.4.0
minor
7 CVEs
CVE-2026-85731
GO-2026-6499
GHSA-m37j-52j7-pjw7
Oct 01, 2026
Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-85732
GO-2026-6497
GHSA-h7vf-4x9w-h99v
Oct 01, 2026
Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-50162
GO-2026-5879
GHSA-8xwf-rjm4-xvhv
Jul 24, 2026
Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-50163
GO-2026-5880
GHSA-fxhp-mv3v-67qp
Jul 24, 2026
Hardlink path traversal during tar extraction in oras.land/oras-go Hardlink path traversal during tar extraction in oras.land/oras-go Fixed in
2.6.2
References Updated Jul 29, 2026 · Source: OSV.dev
CVE-2026-50151
GO-2026-5882
GHSA-jxpm-75mh-9fp7
Jul 24, 2026
Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
GO-2026-5884
GHSA-vh4v-2xq2-g5cg
Jul 24, 2026
ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-48978
GO-2026-5885
GHSA-xf85-363p-868w
Jul 24, 2026
Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Fixed in
2.6.1
References Updated Aug 25, 2026 · Source: OSV.dev |
v2.4.0
minor
Dependencies (3)
|
|
v2.3.1
patch
7 CVEs
CVE-2026-85731
GO-2026-6499
GHSA-m37j-52j7-pjw7
Oct 01, 2026
Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-85732
GO-2026-6497
GHSA-h7vf-4x9w-h99v
Oct 01, 2026
Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-50162
GO-2026-5879
GHSA-8xwf-rjm4-xvhv
Jul 24, 2026
Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-50163
GO-2026-5880
GHSA-fxhp-mv3v-67qp
Jul 24, 2026
Hardlink path traversal during tar extraction in oras.land/oras-go Hardlink path traversal during tar extraction in oras.land/oras-go Fixed in
2.6.2
References Updated Jul 29, 2026 · Source: OSV.dev
CVE-2026-50151
GO-2026-5882
GHSA-jxpm-75mh-9fp7
Jul 24, 2026
Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
GO-2026-5884
GHSA-vh4v-2xq2-g5cg
Jul 24, 2026
ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-48978
GO-2026-5885
GHSA-xf85-363p-868w
Jul 24, 2026
Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Fixed in
2.6.1
References Updated Aug 25, 2026 · Source: OSV.dev |
v2.3.1
patch
Dependencies (3)
|
|
v2.3.0
minor
7 CVEs
CVE-2026-85731
GO-2026-6499
GHSA-m37j-52j7-pjw7
Oct 01, 2026
Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-85732
GO-2026-6497
GHSA-h7vf-4x9w-h99v
Oct 01, 2026
Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-50162
GO-2026-5879
GHSA-8xwf-rjm4-xvhv
Jul 24, 2026
Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-50163
GO-2026-5880
GHSA-fxhp-mv3v-67qp
Jul 24, 2026
Hardlink path traversal during tar extraction in oras.land/oras-go Hardlink path traversal during tar extraction in oras.land/oras-go Fixed in
2.6.2
References Updated Jul 29, 2026 · Source: OSV.dev
CVE-2026-50151
GO-2026-5882
GHSA-jxpm-75mh-9fp7
Jul 24, 2026
Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
GO-2026-5884
GHSA-vh4v-2xq2-g5cg
Jul 24, 2026
ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-48978
GO-2026-5885
GHSA-xf85-363p-868w
Jul 24, 2026
Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Fixed in
2.6.1
References Updated Aug 25, 2026 · Source: OSV.dev |
v2.3.0
minor
Dependencies (3)
|
|
v2.2.1
patch
7 CVEs
CVE-2026-85731
GO-2026-6499
GHSA-m37j-52j7-pjw7
Oct 01, 2026
Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-85732
GO-2026-6497
GHSA-h7vf-4x9w-h99v
Oct 01, 2026
Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-50162
GO-2026-5879
GHSA-8xwf-rjm4-xvhv
Jul 24, 2026
Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-50163
GO-2026-5880
GHSA-fxhp-mv3v-67qp
Jul 24, 2026
Hardlink path traversal during tar extraction in oras.land/oras-go Hardlink path traversal during tar extraction in oras.land/oras-go Fixed in
2.6.2
References Updated Jul 29, 2026 · Source: OSV.dev
CVE-2026-50151
GO-2026-5882
GHSA-jxpm-75mh-9fp7
Jul 24, 2026
Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
GO-2026-5884
GHSA-vh4v-2xq2-g5cg
Jul 24, 2026
ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-48978
GO-2026-5885
GHSA-xf85-363p-868w
Jul 24, 2026
Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Fixed in
2.6.1
References Updated Aug 25, 2026 · Source: OSV.dev |
v2.2.1
patch
Dependencies (3)
|
|
v2.2.0
minor
7 CVEs
CVE-2026-85731
GO-2026-6499
GHSA-m37j-52j7-pjw7
Oct 01, 2026
Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-85732
GO-2026-6497
GHSA-h7vf-4x9w-h99v
Oct 01, 2026
Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-50162
GO-2026-5879
GHSA-8xwf-rjm4-xvhv
Jul 24, 2026
Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-50163
GO-2026-5880
GHSA-fxhp-mv3v-67qp
Jul 24, 2026
Hardlink path traversal during tar extraction in oras.land/oras-go Hardlink path traversal during tar extraction in oras.land/oras-go Fixed in
2.6.2
References Updated Jul 29, 2026 · Source: OSV.dev
CVE-2026-50151
GO-2026-5882
GHSA-jxpm-75mh-9fp7
Jul 24, 2026
Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
GO-2026-5884
GHSA-vh4v-2xq2-g5cg
Jul 24, 2026
ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-48978
GO-2026-5885
GHSA-xf85-363p-868w
Jul 24, 2026
Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Fixed in
2.6.1
References Updated Aug 25, 2026 · Source: OSV.dev |
v2.2.0
minor
Dependencies (3)
|
|
v2.1.0
minor
7 CVEs
CVE-2026-85731
GO-2026-6499
GHSA-m37j-52j7-pjw7
Oct 01, 2026
Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-85732
GO-2026-6497
GHSA-h7vf-4x9w-h99v
Oct 01, 2026
Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-50162
GO-2026-5879
GHSA-8xwf-rjm4-xvhv
Jul 24, 2026
Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-50163
GO-2026-5880
GHSA-fxhp-mv3v-67qp
Jul 24, 2026
Hardlink path traversal during tar extraction in oras.land/oras-go Hardlink path traversal during tar extraction in oras.land/oras-go Fixed in
2.6.2
References Updated Jul 29, 2026 · Source: OSV.dev
CVE-2026-50151
GO-2026-5882
GHSA-jxpm-75mh-9fp7
Jul 24, 2026
Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
GO-2026-5884
GHSA-vh4v-2xq2-g5cg
Jul 24, 2026
ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-48978
GO-2026-5885
GHSA-xf85-363p-868w
Jul 24, 2026
Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Fixed in
2.6.1
References Updated Aug 25, 2026 · Source: OSV.dev |
v2.1.0
minor
Dependencies (3)
|
|
v2.0.2
patch
7 CVEs
CVE-2026-85731
GO-2026-6499
GHSA-m37j-52j7-pjw7
Oct 01, 2026
Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-85732
GO-2026-6497
GHSA-h7vf-4x9w-h99v
Oct 01, 2026
Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-50162
GO-2026-5879
GHSA-8xwf-rjm4-xvhv
Jul 24, 2026
Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-50163
GO-2026-5880
GHSA-fxhp-mv3v-67qp
Jul 24, 2026
Hardlink path traversal during tar extraction in oras.land/oras-go Hardlink path traversal during tar extraction in oras.land/oras-go Fixed in
2.6.2
References Updated Jul 29, 2026 · Source: OSV.dev
CVE-2026-50151
GO-2026-5882
GHSA-jxpm-75mh-9fp7
Jul 24, 2026
Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
GO-2026-5884
GHSA-vh4v-2xq2-g5cg
Jul 24, 2026
ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-48978
GO-2026-5885
GHSA-xf85-363p-868w
Jul 24, 2026
Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Fixed in
2.6.1
References Updated Aug 25, 2026 · Source: OSV.dev |
v2.0.2
patch
Dependencies (3)
|
|
v2.0.1
patch
7 CVEs
CVE-2026-85731
GO-2026-6499
GHSA-m37j-52j7-pjw7
Oct 01, 2026
Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-85732
GO-2026-6497
GHSA-h7vf-4x9w-h99v
Oct 01, 2026
Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-50162
GO-2026-5879
GHSA-8xwf-rjm4-xvhv
Jul 24, 2026
Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-50163
GO-2026-5880
GHSA-fxhp-mv3v-67qp
Jul 24, 2026
Hardlink path traversal during tar extraction in oras.land/oras-go Hardlink path traversal during tar extraction in oras.land/oras-go Fixed in
2.6.2
References Updated Jul 29, 2026 · Source: OSV.dev
CVE-2026-50151
GO-2026-5882
GHSA-jxpm-75mh-9fp7
Jul 24, 2026
Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
GO-2026-5884
GHSA-vh4v-2xq2-g5cg
Jul 24, 2026
ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-48978
GO-2026-5885
GHSA-xf85-363p-868w
Jul 24, 2026
Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Fixed in
2.6.1
References Updated Aug 25, 2026 · Source: OSV.dev |
v2.0.1
patch
Dependencies (3)
|
|
v2.0.0
initial
7 CVEs
CVE-2026-85731
GO-2026-6499
GHSA-m37j-52j7-pjw7
Oct 01, 2026
Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-85732
GO-2026-6497
GHSA-h7vf-4x9w-h99v
Oct 01, 2026
Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-50162
GO-2026-5879
GHSA-8xwf-rjm4-xvhv
Jul 24, 2026
Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-50163
GO-2026-5880
GHSA-fxhp-mv3v-67qp
Jul 24, 2026
Hardlink path traversal during tar extraction in oras.land/oras-go Hardlink path traversal during tar extraction in oras.land/oras-go Fixed in
2.6.2
References Updated Jul 29, 2026 · Source: OSV.dev
CVE-2026-50151
GO-2026-5882
GHSA-jxpm-75mh-9fp7
Jul 24, 2026
Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
GO-2026-5884
GHSA-vh4v-2xq2-g5cg
Jul 24, 2026
ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-48978
GO-2026-5885
GHSA-xf85-363p-868w
Jul 24, 2026
Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Fixed in
2.6.1
References Updated Aug 25, 2026 · Source: OSV.dev |
v2.0.0
initial
Dependencies (3)
|
|
v2.0.0-rc.6
pre
7 CVEs
CVE-2026-85731
GO-2026-6499
GHSA-m37j-52j7-pjw7
Oct 01, 2026
Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-85732
GO-2026-6497
GHSA-h7vf-4x9w-h99v
Oct 01, 2026
Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-50162
GO-2026-5879
GHSA-8xwf-rjm4-xvhv
Jul 24, 2026
Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-50163
GO-2026-5880
GHSA-fxhp-mv3v-67qp
Jul 24, 2026
Hardlink path traversal during tar extraction in oras.land/oras-go Hardlink path traversal during tar extraction in oras.land/oras-go Fixed in
2.6.2
References Updated Jul 29, 2026 · Source: OSV.dev
CVE-2026-50151
GO-2026-5882
GHSA-jxpm-75mh-9fp7
Jul 24, 2026
Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
GO-2026-5884
GHSA-vh4v-2xq2-g5cg
Jul 24, 2026
ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-48978
GO-2026-5885
GHSA-xf85-363p-868w
Jul 24, 2026
Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Fixed in
2.6.1
References Updated Aug 25, 2026 · Source: OSV.dev |
v2.0.0-rc.6
pre
Dependencies (3)
|
|
v2.0.0-rc.5
pre
7 CVEs
CVE-2026-85731
GO-2026-6499
GHSA-m37j-52j7-pjw7
Oct 01, 2026
Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-85732
GO-2026-6497
GHSA-h7vf-4x9w-h99v
Oct 01, 2026
Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-50162
GO-2026-5879
GHSA-8xwf-rjm4-xvhv
Jul 24, 2026
Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-50163
GO-2026-5880
GHSA-fxhp-mv3v-67qp
Jul 24, 2026
Hardlink path traversal during tar extraction in oras.land/oras-go Hardlink path traversal during tar extraction in oras.land/oras-go Fixed in
2.6.2
References Updated Jul 29, 2026 · Source: OSV.dev
CVE-2026-50151
GO-2026-5882
GHSA-jxpm-75mh-9fp7
Jul 24, 2026
Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
GO-2026-5884
GHSA-vh4v-2xq2-g5cg
Jul 24, 2026
ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-48978
GO-2026-5885
GHSA-xf85-363p-868w
Jul 24, 2026
Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Fixed in
2.6.1
References Updated Aug 25, 2026 · Source: OSV.dev |
v2.0.0-rc.5
pre
Dependencies (3)
|
|
v2.0.0-rc.4
pre
7 CVEs
CVE-2026-85731
GO-2026-6499
GHSA-m37j-52j7-pjw7
Oct 01, 2026
Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-85732
GO-2026-6497
GHSA-h7vf-4x9w-h99v
Oct 01, 2026
Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-50162
GO-2026-5879
GHSA-8xwf-rjm4-xvhv
Jul 24, 2026
Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-50163
GO-2026-5880
GHSA-fxhp-mv3v-67qp
Jul 24, 2026
Hardlink path traversal during tar extraction in oras.land/oras-go Hardlink path traversal during tar extraction in oras.land/oras-go Fixed in
2.6.2
References Updated Jul 29, 2026 · Source: OSV.dev
CVE-2026-50151
GO-2026-5882
GHSA-jxpm-75mh-9fp7
Jul 24, 2026
Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
GO-2026-5884
GHSA-vh4v-2xq2-g5cg
Jul 24, 2026
ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-48978
GO-2026-5885
GHSA-xf85-363p-868w
Jul 24, 2026
Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Fixed in
2.6.1
References Updated Aug 25, 2026 · Source: OSV.dev |
v2.0.0-rc.4
pre
Dependencies (3)
|
|
v2.0.0-rc.3
pre
7 CVEs
CVE-2026-85731
GO-2026-6499
GHSA-m37j-52j7-pjw7
Oct 01, 2026
Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-85732
GO-2026-6497
GHSA-h7vf-4x9w-h99v
Oct 01, 2026
Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-50162
GO-2026-5879
GHSA-8xwf-rjm4-xvhv
Jul 24, 2026
Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-50163
GO-2026-5880
GHSA-fxhp-mv3v-67qp
Jul 24, 2026
Hardlink path traversal during tar extraction in oras.land/oras-go Hardlink path traversal during tar extraction in oras.land/oras-go Fixed in
2.6.2
References Updated Jul 29, 2026 · Source: OSV.dev
CVE-2026-50151
GO-2026-5882
GHSA-jxpm-75mh-9fp7
Jul 24, 2026
Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
GO-2026-5884
GHSA-vh4v-2xq2-g5cg
Jul 24, 2026
ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-48978
GO-2026-5885
GHSA-xf85-363p-868w
Jul 24, 2026
Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Fixed in
2.6.1
References Updated Aug 25, 2026 · Source: OSV.dev |
v2.0.0-rc.3
pre
Dependencies (5)
|
|
v2.0.0-rc.2
pre
7 CVEs
CVE-2026-85731
GO-2026-6499
GHSA-m37j-52j7-pjw7
Oct 01, 2026
Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-85732
GO-2026-6497
GHSA-h7vf-4x9w-h99v
Oct 01, 2026
Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-50162
GO-2026-5879
GHSA-8xwf-rjm4-xvhv
Jul 24, 2026
Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-50163
GO-2026-5880
GHSA-fxhp-mv3v-67qp
Jul 24, 2026
Hardlink path traversal during tar extraction in oras.land/oras-go Hardlink path traversal during tar extraction in oras.land/oras-go Fixed in
2.6.2
References Updated Jul 29, 2026 · Source: OSV.dev
CVE-2026-50151
GO-2026-5882
GHSA-jxpm-75mh-9fp7
Jul 24, 2026
Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
GO-2026-5884
GHSA-vh4v-2xq2-g5cg
Jul 24, 2026
ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-48978
GO-2026-5885
GHSA-xf85-363p-868w
Jul 24, 2026
Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Fixed in
2.6.1
References Updated Aug 25, 2026 · Source: OSV.dev |
v2.0.0-rc.2
pre
Dependencies (5)
|
|
v2.0.0-rc.1
pre
7 CVEs
CVE-2026-85731
GO-2026-6499
GHSA-m37j-52j7-pjw7
Oct 01, 2026
Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-85732
GO-2026-6497
GHSA-h7vf-4x9w-h99v
Oct 01, 2026
Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-50162
GO-2026-5879
GHSA-8xwf-rjm4-xvhv
Jul 24, 2026
Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-50163
GO-2026-5880
GHSA-fxhp-mv3v-67qp
Jul 24, 2026
Hardlink path traversal during tar extraction in oras.land/oras-go Hardlink path traversal during tar extraction in oras.land/oras-go Fixed in
2.6.2
References Updated Jul 29, 2026 · Source: OSV.dev
CVE-2026-50151
GO-2026-5882
GHSA-jxpm-75mh-9fp7
Jul 24, 2026
Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
GO-2026-5884
GHSA-vh4v-2xq2-g5cg
Jul 24, 2026
ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-48978
GO-2026-5885
GHSA-xf85-363p-868w
Jul 24, 2026
Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Fixed in
2.6.1
References Updated Aug 25, 2026 · Source: OSV.dev |
v2.0.0-rc.1
pre
Dependencies (5)
|
|
v2.0.0-alpha
pre
7 CVEs
CVE-2026-85731
GO-2026-6499
GHSA-m37j-52j7-pjw7
Oct 01, 2026
Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-85732
GO-2026-6497
GHSA-h7vf-4x9w-h99v
Oct 01, 2026
Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go Fixed in
2.6.2
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-50162
GO-2026-5879
GHSA-8xwf-rjm4-xvhv
Jul 24, 2026
Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-50163
GO-2026-5880
GHSA-fxhp-mv3v-67qp
Jul 24, 2026
Hardlink path traversal during tar extraction in oras.land/oras-go Hardlink path traversal during tar extraction in oras.land/oras-go Fixed in
2.6.2
References Updated Jul 29, 2026 · Source: OSV.dev
CVE-2026-50151
GO-2026-5882
GHSA-jxpm-75mh-9fp7
Jul 24, 2026
Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
GO-2026-5884
GHSA-vh4v-2xq2-g5cg
Jul 24, 2026
ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go Fixed in
2.6.1
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-48978
GO-2026-5885
GHSA-xf85-363p-868w
Jul 24, 2026
Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go Fixed in
2.6.1
References Updated Aug 25, 2026 · Source: OSV.dev |
v2.0.0-alpha
pre
Dependencies (4)
|