Oras-Project

5 CVEs across 2 Oras-Project products. Browse Oras-Project vulnerabilities, severities, and proof-of-concept exploits.

Oras-Project products with known CVEs

ProductCVEs
Oras-Go4
Oras1
Oras-Project CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-55588Medium6.52026-08-25ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive ref…
CVE-2026-50163High7.12026-07-17oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the…
CVE-2026-501622026-07-17oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir…
CVE-2026-50151High7.52026-07-17oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-…
CVE-2026-489782026-07-17oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge with…