Is CVE-2026-55588 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55588 being exploited in the wild.

How severe is CVE-2026-55588?

Medium severity, with a CVSS score of 6.5, published 25 August 2026.

Which products and versions are affected?

oras.land/oras (Go) < 1.3.3, SEMVER:introduced=0,fixed=1.3.3; ORAS Project ORAS CLI < 1.3.3.

Is there a fix for CVE-2026-55588?

Yes. oras.land/oras (Go): upgrade to 1.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55588 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-55588?

Check whether you run oras.land/oras (Go) or ORAS Project ORAS CLI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55588: ORAS CLI uncontrolled recursion in referrer graph traversal

Q: Which products and versions are affected?

oras.land/oras (Go) < 1.3.3, SEMVER:introduced=0,fixed=1.3.3; ORAS Project ORAS CLI < 1.3.3.

Q: Is there a fix for CVE-2026-55588?

Yes. oras.land/oras (Go): upgrade to 1.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55588 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-55588?

Check whether you run oras.land/oras (Go) or ORAS Project ORAS CLI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55588 · Severity: medium · CVSS 6.5 · Published 2026-08-25

ORAS CLI is a command-line tool for managing container artifacts in OCI registries. When processing artifact metadata from a registry, ORAS can fall into infinite loops if the registry returns a circular graph of artifact references (e.g., artifact A points to itself or creates a cycle A→B→A). This causes the tool to consume unbounded CPU and memory, stalling CI/CD pipelines, automation jobs, and backup/restore operations until the process crashes or hangs.

Vendors: Go, ORAS Project.

Quick answers

Is CVE-2026-55588 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55588 being exploited in the wild.
How severe is CVE-2026-55588?: Medium severity, with a CVSS score of 6.5, published 25 August 2026.
Which products and versions are affected?: oras.land/oras (Go) < 1.3.3, SEMVER:introduced=0,fixed=1.3.3; ORAS Project ORAS CLI < 1.3.3.
Is there a fix for CVE-2026-55588?: Yes. oras.land/oras (Go): upgrade to 1.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55588 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-55588?: Check whether you run oras.land/oras (Go) or ORAS Project ORAS CLI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

oras.land/oras (Go): upgrade to 1.3.3 or later
```
go get oras.land/oras@v1.3.3
```

Technical details

The vulnerability is an uncontrolled recursion issue (CWE-674) in ORAS CLI's referrer graph traversal logic. The `oras discover` command and the recursive counting functions used by `oras backup` and `oras restore` do not maintain a set of visited descriptors. When a malicious OCI registry returns cyclic referrer graphs (e.g., referrers(A)=[A] or referrers(A)=[B], referrers(B)=[A]), the recursive traversal never terminates because visited state is not tracked. An attacker controlling a registry can trigger this via the network by serving metadata with cycles. The `oras discover --depth` option defaults to unlimited recursion depth, making discovery vulnerable out of the box. Patches thread a visited-descriptor set through traversal to break cycles. This affects ORAS CLI versions prior to 1.3.3.

Affected products

ORAS Project ORAS CLI < 1.3.3

Identifiers

CVE-2026-55588
GHSA-298f-872v-2rcx
GO-2026-6317

Timeline

2026-08-28: disclosed: Advisory published to GitHub Advisory Database
2026: patched: Patched in version 1.3.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.