Summary
ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption
A malicious OCI registry can return a cyclic referrer graph (e.g. A -> A or A -> B -> A). The ORAS CLI's recursive referrer traversal does not track visited descriptors, so a cycle causes unbounded recursion and memory growth, a client-side denial of service.
This affects oras discover (recursive referrer traversal) and the recursive referrer counting used by oras backup and oras restore. Because oras discover --depth defaults to 0 (unlimited), discover is affected out of the box.
Note: This advisory covers only the ORAS CLI (oras.land/oras). The related Referrers API pagination loop in the oras-go library is tracked in a separate advisory on the oras-go repository.
Details
In oras discover, recursive referrer traversal follows discovered referrers without maintaining a visited-descriptor set.
Simplified flow:
runDiscover
-> fetchAllReferrers(root)
-> registry.Referrers(root)
-> for each referrer:
fetchAllReferrers(referrer)
A malicious registry can create cyclic graphs such as:
A -> A
or
A -> B -> A
Because traversal does not track previously visited descriptors, recursion never reaches a terminating condition.
Similarly, the recursive counting logic (graph.RecursiveFindReferrers, used by the backup and restore workflows) accumulates descriptors without cycle detection, causing unbounded memory growth.
PoC
Create valid descriptors where:
referrers(A) = [A]
or:
referrers(A) = [B]
referrers(B) = [A]
Run:
oras discover attacker.local/repo@sha256:<A>
The recursive traversal continues indefinitely, causing unbounded recursion and eventual resource exhaustion.
Impact
A malicious OCI registry can trigger client-side denial of service against ORAS CLI users and automation.
Potential impacts include:
- Excessive CPU utilization
- Excessive memory consumption
- Unbounded recursion
- Hung CI/CD jobs
- Stalled automation pipelines
- Failed backup or discovery operations
The issue does not enable arbitrary code execution, artifact substitution, or integrity bypass, but it can reliably prevent ORAS operations from completing when interacting with malicious registry metadata.
Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service. Typical impact: denial of service.
CVE-2026-55588 has a CVSS score of 2.0 (Low). The vector is network-reachable, high privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.3.3); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
cmd/oras/root/discover.go,fetchAllReferrersthreads avisiteddigest set; an already-traversed descriptor returns immediately, breaking cycles. Behavior is unchanged for valid (acyclic) referrer graphs.internal/graph/graph.go,RecursiveFindReferrerstracks visited descriptors by digest and only recurses into unseen referrers, so traversal terminates on a cyclic graph.
Frequently Asked Questions
- What is CVE-2026-55588? CVE-2026-55588 is a low-severity uncontrolled resource consumption vulnerability in oras.land/oras (go), affecting versions < 1.3.3. It is fixed in 1.3.3. Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service.
- How severe is CVE-2026-55588? CVE-2026-55588 has a CVSS score of 2.0 (Low). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of oras.land/oras are affected by CVE-2026-55588? oras.land/oras (go) versions < 1.3.3 is affected.
- Is there a fix for CVE-2026-55588? Yes. CVE-2026-55588 is fixed in 1.3.3. Upgrade to this version or later.
- Is CVE-2026-55588 exploitable, and should I be worried? Whether CVE-2026-55588 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-55588 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-55588? Upgrade
oras.land/orasto 1.3.3 or later.