CVE-2026-55588

Name of the Vulnerable Software and Affected Versions ORAS CLI versions prior to 1.3.3

Description Recursive referrer traversal fails to track visited descriptors, allowing a malicious OCI registry to return a cyclic referrer graph. This leads to unbounded recursion and memory growth, resulting in a client-side denial of service that exhausts CPU and memory. This issue impacts the oras discover command, where the --depth option defaults to 0 (unlimited), and the recursive referrer counting used in oras backup and oras restore workflows. A cyclic graph occurs when one element refers to another, which then refers back to the first. This can hang automation or CI/CD pipelines interacting with untrusted registry metadata.

Recommendations Update to version 1.3.3.