Aditya19200

**Name of the Vulnerable Software and Affected Versions** ORAS CLI versions prior to 1.3.3 **Description** Recursive referrer traversal fails to track visited descriptors, allowing a malicious OCI registry to return a cyclic referrer graph. This leads to unbounded recursion and memory growth, resulting in a client-side denial of service that exhausts CPU and memory. This issue impacts the `oras discover` command, where the `--depth` option defaults to 0 (unlimited), and the recursive referrer counting used in `oras backup` and `oras restore` workflows. A cyclic graph occurs when one element refers to another, which then refers back to the first. This can hang automation or CI/CD pipelines interacting with untrusted registry metadata. **Recommendations** Update to version 1.3.3.