Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-55588, describes a client-side denial of service in ORAS CLI due to unbounded recursion when processing cyclic referrer graphs from a malicious OCI registry. The core issue is the lack of cycle detection in recursive referrer traversal functions. The provided commit 440eb65d07a0631f131944d28e7c29d562ec17f3 directly addresses this by introducing visited maps to two key functions responsible for referrer traversal.
root.fetchAllReferrers in cmd/oras/root/discover.go: This function is explicitly mentioned in the vulnerability description as affecting oras discover. The patch modifies its signature to accept a visited map[digest.Digest]bool and adds logic at the beginning of the function to check if a descriptor has already been visited. If so, it returns early, preventing infinite recursion. The recursive call within this function is also updated to pass this visited map.
graph.RecursiveFindReferrers in internal/graph/graph.go: This function is identified in the commit message as being used by oras backup and oras restore workflows for recursive referrer counting. The patch introduces a visited map within this function's loop. Before processing a referrer, it checks if it has been visited. If it has, it's skipped; otherwise, it's marked as visited and added to the list for further processing. This mechanism effectively breaks cycles in the referrer graph.
Both functions, in their pre-patch state, lacked the necessary cycle detection, making them vulnerable to unbounded recursion and resource consumption when interacting with a maliciously crafted OCI registry. The changes directly mitigate this by ensuring that each descriptor is processed only once, even in the presence of cycles.
root.fetchAllReferrerscmd/oras/root/discover.go
graph.RecursiveFindReferrersinternal/graph/graph.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| oras.land/oras | go | < 1.3.3 | 1.3.3 |