# CVE-2026-55588: ORAS CLI uncontrolled recursion in referrer graph traversal

Source: https://junglewise.ai/threats/cve-2026-55588-oras-cli-uncontrolled-recursion-in-referrer-graph-traversal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-55588 · Severity: medium · CVSS 6.5 · Published 2026-08-25

ORAS CLI is a command-line tool for managing container artifacts in OCI registries. When processing artifact metadata from a registry, ORAS can fall into infinite loops if the registry returns a circular graph of artifact references (e.g., artifact A points to itself or creates a cycle A→B→A). This causes the tool to consume unbounded CPU and memory, stalling CI/CD pipelines, automation jobs, and backup/restore operations until the process crashes or hangs.

Vendors: [Go](https://junglewise.ai/threats/vendors/go), [ORAS Project](https://junglewise.ai/threats/vendors/oras-project).

## Quick answers

**Is CVE-2026-55588 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55588 being exploited in the wild.

**How severe is CVE-2026-55588?** Medium severity, with a CVSS score of 6.5, published 25 August 2026.

**Which products and versions are affected?** oras.land/oras (Go) < 1.3.3, SEMVER:introduced=0,fixed=1.3.3; ORAS Project ORAS CLI < 1.3.3.

**Is there a fix for CVE-2026-55588?** Yes. oras.land/oras (Go): upgrade to 1.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55588 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55588?** Check whether you run oras.land/oras (Go) or ORAS Project ORAS CLI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- oras.land/oras (Go): upgrade to 1.3.3 or later

  ```sh
  go get oras.land/oras@v1.3.3
  ```


## Technical details

The vulnerability is an uncontrolled recursion issue (CWE-674) in ORAS CLI's referrer graph traversal logic. The `oras discover` command and the recursive counting functions used by `oras backup` and `oras restore` do not maintain a set of visited descriptors. When a malicious OCI registry returns cyclic referrer graphs (e.g., referrers(A)=[A] or referrers(A)=[B], referrers(B)=[A]), the recursive traversal never terminates because visited state is not tracked. An attacker controlling a registry can trigger this via the network by serving metadata with cycles. The `oras discover --depth` option defaults to unlimited recursion depth, making discovery vulnerable out of the box. Patches thread a visited-descriptor set through traversal to break cycles. This affects ORAS CLI versions prior to 1.3.3.

## Affected products

- ORAS Project ORAS CLI < 1.3.3

## Identifiers

- CVE-2026-55588
- GHSA-298f-872v-2rcx
- GO-2026-6317

## Timeline

- 2026-08-28: disclosed: Advisory published to GitHub Advisory Database
- 2026: patched: Patched in version 1.3.3

## References

- [https://api.github.com/users/aditya19200](https://api.github.com/users/aditya19200)
- [https://github.com/aditya19200](https://github.com/aditya19200)
- [https://api.github.com/users/aditya19200/gists%7B/gist_id%7D](https://api.github.com/users/aditya19200/gists%7B/gist_id%7D)
- [https://api.github.com/users/aditya19200/repos](https://api.github.com/users/aditya19200/repos)
- [https://avatars.githubusercontent.com/u/145135317?v=4](https://avatars.githubusercontent.com/u/145135317?v=4)
- [https://api.github.com/users/aditya19200/events%7B/privacy%7D](https://api.github.com/users/aditya19200/events%7B/privacy%7D)