Oras vulnerabilities

1 known vulnerability in Oras from Linux Foundation. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  oras-go: Server-Side Request Forgery

  CVE-2026-50151Jul 17, 2026Oras-project

  oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the