Security
فارسی
All products

oras.land/oras-go/v2

Go · Package
7 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probingCVE-2026-85732 · GHSA-H7VF-4X9W-H99VVersion ranges need review. oras.land/oras-go/v2Red Hat OpenShift AI (RHOAI)/rhoai/odh-ai-gateway-operator-rhel9 GoRed Hat Medium Fix reported
oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)CVE-2026-85731 · GHSA-M37J-52J7-PJW7Version ranges need review. oras.land/oras-go/v2Red Hat OpenShift AI (RHOAI)/rhoai/odh-ai-gateway-operator-rhel9 GoRed Hat High Fix reported
ORAS Go forwards registry credentials across registry redirectsGHSA-VH4V-2XQ2-G5CG · GO-2026-5884Version ranges need review. oras.land/oras-go/v2 Go Medium Fix reported
oras-go has file store write outside workingDir via symlink traversalCVE-2026-50162 · GHSA-8XWF-RJM4-XVHVVersion ranges need review. oras.land/oras-go/v2Assisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 GoRed Hat Medium Fix reported
oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokensCVE-2026-48978 · GHSA-XF85-363P-868WVersion ranges need review. oras.land/oras-go/v2oras.land/oras-go GoRed Hat Low Fix reported
oras-go blob upload vulnerable to credential forwarding via unvalidated Location headerCVE-2026-50151 · GHSA-JXPM-75MH-9FP7Version ranges need review. oras.land/oras-go/v2OpenShift Service Mesh 3/openshift-service-mesh/istio-rhel9-operator GoRed Hat High Fix reported
`oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolutionCVE-2026-50163 · GHSA-FXHP-MV3V-67QPVersion ranges need review. oras.land/oras-go/v2Gatekeeper 3/gatekeeper/gatekeeper-rhel9 GoRed Hat High Fix reported