CVE-2026-55588: ORAS CLI Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-298f-872v-2rcx",
  "modified" : "2026-08-28T18:19:15Z",
  "published" : "2026-08-28T18:19:15Z",
  "aliases" : [ "CVE-2026-55588" ],
  "summary" : "ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption",
  "details" : "### Summary\n\nA malicious OCI registry can return a **cyclic referrer graph** (e.g. `A -> A` or `A -> B -> A`). The ORAS CLI's recursive referrer traversal does not track visited descriptors, so a cycle causes unbounded recursion and memory growth — a client-side denial of service.\n\nThis affects `oras discover` (recursive referrer traversal) and the recursive referrer counting used by `oras backup` and `oras restore`. Because `oras discover --depth` defaults to `0` (unlimited), `discover` is affected out of the box.\n\n> **Note:** This advisory covers only the **ORAS CLI** (`oras.land/oras`). The related Referrers API pagination loop in the `oras-go` library is tracked in a separate advisory on the [oras-go](https://github.com/oras-project/oras-go) repository.\n\n### Details\n\nIn `oras discover`, recursive referrer traversal follows discovered referrers without maintaining a visited-descriptor set.\n\nSimplified flow:\n\n```text\nrunDiscover\n  -> fetchAllReferrers(root)\n     -> registry.Referrers(root)\n     -> for each referrer:\n          fetchAllReferrers(referrer)\n```\n\nA malicious registry can create cyclic graphs such as:\n\n```text\nA -> A\n```\n\nor\n\n```text\nA -> B -> A\n```\n\nBecause traversal does not track previously visited descriptors, recursion never reaches a terminating condition.\n\nSimilarly, the recursive counting logic (`graph.RecursiveFindReferrers`, used by the `backup` and `restore` workflows) accumulates descriptors without cycle detection, causing unbounded memory growth.\n\n### PoC\n\nCreate valid descriptors where:\n\n```text\nreferrers(A) = [A]\n```\n\nor:\n\n```text\nreferrers(A) = [B]\nreferrers(B) = [A]\n```\n\nRun:\n\n```bash\noras discover attacker.local/repo@sha256:<A>\n```\n\nThe recursive traversal continues indefinitely, causing unbounded recursion and eventual resource exhaustion.\n\n### Impact\n\nA malicious OCI registry can trigger client-side denial of service against ORAS CLI users and automation.\n\nPotential impacts include:\n\n- Excessive CPU utilization\n- Excessive memory consumption\n- Unbounded recursion\n- Hung CI/CD jobs\n- Stalled automation pipelines\n- Failed backup or discovery operations\n\nThe issue does not enable arbitrary code execution, artifact substitution, or integrity bypass, but it can reliably prevent ORAS operations from completing when interacting with malicious registry metadata.\n\n### Patch\n\n- `cmd/oras/root/discover.go` — `fetchAllReferrers` threads a `visited` digest set; an already-traversed descriptor returns immediately, breaking cycles. Behavior is unchanged for valid (acyclic) referrer graphs.\n- `internal/graph/graph.go` — `RecursiveFindReferrers` tracks visited descriptors by digest and only recurses into unseen referrers, so traversal terminates on a cyclic graph.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "oras.land/oras"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.3.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/oras-project/oras/security/advisories/GHSA-298f-872v-2rcx"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-55588"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/oras-project/oras/commit/440eb65d07a0631f131944d28e7c29d562ec17f3"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/oras-project/oras"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-400", "CWE-674", "CWE-835" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-28T18:19:15Z",
    "nvd_published_at" : "2026-08-25T21:17:02Z"
  }
}