Oras-Project Oras-Go
6 CVEs affecting Oras-Project Oras-Go. Latest disclosed: 2026-09-16. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-85731 | High | 8.8 | 2026-09-16 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true ca… |
CVE-2026-50151 | High | 7.5 | 2026-07-17 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-… |
CVE-2026-50163 | High | 7.1 | 2026-07-17 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the… |
CVE-2026-85732 | Medium | 4.7 | 2026-09-16 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-… |
CVE-2026-50162 | | 2026-07-17 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir… | |
CVE-2026-48978 | | 2026-07-17 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge with… |