Description

ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded recursion and memory growth. This affects oras discover, whose recursive traversal is enabled by default because the --depth option defaults to 0 (unlimited), as well as the recursive referrer counting used by the oras backup and oras restore workflows. A cyclic graph can be as simple as A referring to B and B referring back to A. A malicious registry can use this to cause a client-side denial of service, exhausting CPU and memory and hanging automation or CI/CD pipelines that run ORAS against untrusted registry metadata. The vulnerability does not extend to code execution, artifact substitution, or integrity bypass. This issue has been fixed in version 1.3.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-25T21:17:02.350Z",
  "pubdate": "2026-08-25T21:17:02.350Z",
  "executiveSummary": "ORAS CLI versions 1.3.2 and earlier are vulnerable to a resource exhaustion vulnerability within the recursive referrer traversal mechanism.\nThe vulnerability allows a malicious OCI registry to trigger unbounded recursion by serving cyclic descriptor graphs, leading to a client-side denial-of-service (DoS) condition.\nThis impact extends to automated workflows including 'oras discover', 'oras backup', and 'oras restore', where the default traversal depth is unlimited.\nExploitation does not require authentication to the malicious registry but does require the client to perform operations against the registry's untrusted metadata.\nSuccessful exploitation results in significant CPU and memory consumption, potentially crashing the client process or hanging CI/CD pipelines.\nThe vulnerability does not facilitate remote code execution, unauthorized artifact substitution, or integrity bypasses.",
  "technicalDetails": "The root cause of this vulnerability is the absence of a visited descriptor tracking mechanism during recursive referrer traversal in the ORAS CLI and library. OCI registries manage artifacts through a directed graph of descriptors. The ORAS recursive traversal logic fails to maintain state regarding previously visited nodes within this graph.\nIn a standard implementation, recursive graph traversal requires a 'seen' set to detect cycles. Without this, a cyclic reference—for instance, Descriptor A referencing Descriptor B, and Descriptor B referencing Descriptor A—creates an infinite loop when the traversal algorithm attempts to resolve the graph structure.\nThe affected components include the 'oras discover' command, where the '--depth' parameter defaults to '0' (unlimited), as well as the underlying logic used in 'oras backup' and 'oras restore'. When interacting with a malicious registry, the ORAS client initiates a request for referrer metadata. The attacker-controlled registry responds with a crafted graph containing cyclical dependencies.\nThe attack flow proceeds as follows: First, an attacker hosts a malicious OCI registry containing cyclic referrer metadata. Second, a user or automated pipeline executes an ORAS command (e.g., 'oras discover') targeting this repository. Third, the ORAS client fetches the initial manifest. Fourth, as the recursive traversal initiates, the client enters an infinite recursion loop due to the cyclic graph structure. Finally, as the stack grows and memory usage spikes, the ORAS process consumes available system resources, resulting in a denial-of-service condition that effectively halts the process and any parent automation systems.\nThis vulnerability specifically impacts ORAS CLI and library versions up to and including 1.3.2. Because this is a client-side resource exhaustion issue triggered by external data, it does not bypass the cryptographic integrity checks of the artifacts themselves, nor does it provide a vector for arbitrary code execution on the client host."
}