CVE-2026-55588 Overview
CVE-2026-55588 affects ORAS (OCI Registry As Storage), a command-line interface and library for managing artifacts in Open Container Initiative (OCI) registries. Versions up to and including 1.3.2 fail to track visited descriptors during recursive referrer traversal. A malicious registry returning a cyclic referrer graph triggers unbounded recursion and memory growth in the ORAS client. The flaw impacts oras discover, whose recursive traversal is enabled by default because --depth defaults to 0 (unlimited), along with the recursive referrer counting used by oras backup and oras restore. Version 1.3.3 contains the fix.
Critical Impact
A malicious OCI registry can hang or crash automation and CI/CD pipelines that invoke ORAS against untrusted registry metadata, exhausting client CPU and memory.
Affected Products
- ORAS CLI versions up to and including 1.3.2
- oras discover command (recursive traversal enabled by default)
- oras backup and oras restore workflows using recursive referrer counting
Discovery Timeline
- 2026-08-25 - CVE-2026-55588 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-55588
Vulnerability Analysis
ORAS uses recursive traversal to walk the referrer graph attached to an OCI artifact. Each descriptor may reference other descriptors, which the client fetches and processes in turn. The vulnerable implementation never records which descriptors have already been visited. When a registry returns a graph where descriptor A references B and B references back to A, the traversal loops indefinitely. Memory usage and CPU consumption grow without bound until the process is killed or the host runs out of resources.
The issue is classified as uncontrolled resource consumption [CWE-400]. Impact is limited to availability. The vulnerability does not enable code execution, artifact substitution, or integrity bypass on the client.
Root Cause
The recursive referrer walker in internal/graph/graph.go and the caller in cmd/oras/root/discover.go lacked a visited-set keyed by content digest. Any cycle in the registry's referrer graph produced infinite recursion. The default --depth=0 setting for oras discover removes the natural termination condition that a bounded depth would otherwise provide.
Attack Vector
An attacker operates or compromises an OCI registry that a victim's ORAS client contacts. The attacker crafts referrer manifests forming a cycle between two or more descriptors. When the victim runs oras discover, oras backup, or oras restore against that registry, the client enters unbounded recursion. Exploitation requires the user to interact with the malicious registry but no authentication on the client side.
// Patch: add digest-based tracking to prevent cycles
// cmd/oras/root/discover.go
"errors"
"fmt"
+ "github.com/opencontainers/go-digest"
ocispec "github.com/opencontainers/image-spec/specs-go/v1"
"github.com/spf13/cobra"
// internal/graph/graph.go
"encoding/json"
"sync"
+ "github.com/opencontainers/go-digest"
ocispec "github.com/opencontainers/image-spec/specs-go/v1"
"golang.org/x/sync/errgroup"
"oras.land/oras-go/v2"
Source: GitHub commit 440eb65. The patch introduces go-digest imports to track visited descriptors by digest during graph traversal.
Detection Methods for CVE-2026-55588
Indicators of Compromise
- ORAS client processes with runaway memory growth or sustained high CPU during discover, backup, or restore operations.
- CI/CD job timeouts or out-of-memory kills correlated with ORAS invocations against external registries.
- Long-running outbound HTTPS sessions from build agents to unfamiliar or untrusted OCI registry hosts.
Detection Strategies
- Inventory build agents and container tooling for oras binaries and check versions against 1.3.3.
- Instrument CI/CD runners to record process resource usage for ORAS commands and alert on outliers.
- Log the target registry URL for every ORAS invocation and compare against an allowlist of trusted registries.
Monitoring Recommendations
- Track memory and CPU ceilings on job runners; treat repeated OOM kills of oras as a signal to investigate.
- Monitor egress from build infrastructure for connections to OCI registries outside the approved set.
- Review ORAS command history in pipeline logs for use of oras discover without an explicit --depth value.
How to Mitigate CVE-2026-55588
Immediate Actions Required
- Upgrade ORAS CLI to version 1.3.3 or later on every workstation, build agent, and container image that ships the binary.
- Restrict ORAS operations to trusted registries until upgrades are complete.
- Audit CI/CD pipelines for oras discover, oras backup, and oras restore steps that consume untrusted registry metadata.
Patch Information
The fix ships in ORAS 1.3.3. Technical details are documented in GHSA-298f-872v-2rcx and the corresponding remediation commit 440eb65, which adds visited-descriptor tracking to the recursive referrer walker.
Workarounds
- Pass an explicit non-zero --depth value to oras discover to bound recursion when upgrading is not immediately possible.
- Apply CPU and memory limits (for example, ulimit or container resources.limits) to jobs that invoke ORAS so a runaway process is terminated.
- Block network access from build agents to OCI registries that are not on an approved allowlist.
# Upgrade ORAS to a fixed version
curl -LO https://github.com/oras-project/oras/releases/download/v1.3.3/oras_1.3.3_linux_amd64.tar.gz
tar -xzf oras_1.3.3_linux_amd64.tar.gz oras
sudo install -m 0755 oras /usr/local/bin/oras
oras version
# Bound recursion as a temporary workaround on 1.3.2 or earlier
oras discover --depth 3 registry.example.com/repo:tag
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
