CVE-2026-55588 in oras
Summary
by MITRE • 08/26/2026
ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded recursion and memory growth. This affects oras discover, whose recursive traversal is enabled by default because the --depth option defaults to 0 (unlimited), as well as the recursive referrer counting used by the oras backup and oras restore workflows. A cyclic graph can be as simple as A referring to B and B referring back to A. A malicious registry can use this to cause a client-side denial of service, exhausting CPU and memory and hanging automation or CI/CD pipelines that run ORAS against untrusted registry metadata. The vulnerability does not extend to code execution, artifact substitution, or integrity bypass. This issue has been fixed in version 1.3.3.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The OCI Registry As Storage tooling, commonly referred to as ORAS, serves as a critical command-line interface and library for managing artifacts within Open Container Initiative registries. In versions up through 1.3.2, the software contains a significant logic flaw in its handling of referrer graphs during recursive traversal operations. The vulnerability stems from an absence of state tracking for visited descriptors when traversing these graph structures. Specifically, the oras discover command enables recursive traversal by default because the depth parameter defaults to zero, indicating unlimited recursion. Similarly, the backup and restore workflows rely on this same recursive mechanism to count referrers. When interacting with a malicious OCI registry that constructs a cyclic referrer graph, such as one where artifact A refers to B and B refers back to A, the traversal algorithm fails to detect previously visited nodes. This oversight leads directly to unbounded recursion, causing the client application to enter an infinite loop of processing references without termination conditions based on visitation history.
The operational impact of this flaw is primarily a client-side denial of service resulting from resource exhaustion. As the recursive function continues indefinitely, it consumes increasing amounts of central processing unit time and memory allocation with each iteration. This behavior can cause the ORAS process to hang or crash entirely due to out-of-memory conditions. For organizations utilizing automated workflows, such as CI/CD pipelines that invoke ORAS against potentially untrusted registry metadata, this vulnerability poses a severe availability risk. The automation may become stuck indefinitely, blocking deployment processes and disrupting development lifecycles. It is important to note the boundaries of this impact; while the resource exhaustion is significant, the flaw does not facilitate arbitrary code execution on the client machine, nor does it allow for artifact substitution or bypassing integrity checks within the registry itself. The attack vector relies entirely on the registry returning a specifically crafted cyclic graph to trigger the local resource consumption.
From a security classification perspective, this vulnerability aligns with CWE-674, which describes uncontrolled recursion leading to stack overflow or memory exhaustion. It also relates to CWE-835 regarding loop errors that result in infinite loops. In terms of adversary tactics, this flaw can be leveraged within the ATT&CK framework under T1499, Endpoint Denial of Service, specifically as an application layer attack designed to exhaust system resources rather than compromising confidentiality or integrity directly. The lack of visited node tracking is a common pattern error in graph traversal algorithms that must be explicitly addressed by maintaining a set of seen identifiers during recursive descent.
The recommended mitigation for this issue is the immediate upgrade to ORAS version 1.3.3, which implements proper state management to track visited descriptors and prevent cyclic recursion. For environments where upgrading is not immediately feasible, operators can mitigate the risk by explicitly setting the depth parameter in oras discover commands to a finite integer value greater than zero. This limits the maximum number of recursive levels traversed, thereby preventing infinite loops even if a cyclic graph is encountered. Additionally, organizations should exercise caution when configuring automated pipelines that interact with external or untrusted OCI registries, ensuring that timeout mechanisms are configured at both the application and network layers to terminate hung processes before they exhaust system resources completely.