CVE-2026-55588 - ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption
Brief
CVE ID : CVE-2026-55588
Published : Aug. 25, 2026, 8:32 p. m.
- 40 minutes ago
Description : ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.
- 2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded recursion and memory growth.
This affects oras discover, whose recursive traversal is enabled by default because the --depth option defaults to 0 (unlimited), as well as the recursive referrer counting used by the oras backup and oras restore workflows. A cyclic graph can be as simple as A referring to B and B referring back to A.