Listen to this Post
ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors. This allows a malicious OCI registry to return a cyclic referrer graph, such as `A -> A` or A -> B -> A, which causes unbounded recursion and memory growth.
The vulnerability primarily affects the `oras discover` command, whose recursive traversal is enabled by default because the `–depth` option defaults to `0` (unlimited). It also impacts the recursive referrer counting used by the `oras backup` and `oras restore` workflows.
The issue stems from a missing visited-descriptor set. In the simplified flow of oras discover, the process calls fetchAllReferrers(root), which then calls `registry.Referrers(root)` and, for each referrer, calls `fetchAllReferrers(referrer)` again. Without tracking which descriptors have already been visited, a cyclic graph causes the recursion to never terminate. Similarly, the `graph.RecursiveFindReferrers` function used in backup and restore workflows accumulates descriptors without cycle detection, leading to unbounded memory growth.
A malicious registry can exploit this by returning a cyclic graph, causing the ORAS CLI to enter an infinite loop. This results in excessive CPU and memory consumption, which can hang the ORAS process or crash it entirely due to out-of-memory conditions. For organizations using ORAS in automated CI/CD pipelines against untrusted registry metadata, this poses a severe availability risk, as the automation may become stuck indefinitely. The vulnerability does not enable arbitrary code execution, artifact substitution, or integrity bypass. It is classified under CWE-674 (Uncontrolled Recursion).
The issue has been fixed in ORAS version 1.3.3. The patch introduces a visited digest set in `fetchAllReferrers` to break cycles, and `RecursiveFindReferrers` now tracks visited descriptors by digest, only recursing into unseen referrers.
DailyCVE Form:
Platform: ORAS CLI
Version: <=1.3.2
Vulnerability : Unbounded Recursion
Severity: Low
date: 2026-08-28
Prediction: Already Patched (1.3.3)
What Undercode Say:
Analytics:
The core of this vulnerability is a classic graph traversal error: the absence of a “visited” set. When the ORAS CLI recursively follows referrers, it does not check if a descriptor has already been processed. This allows a malicious registry to create a cycle, causing the recursion to deepen indefinitely. This is a client-side Denial of Service (DoS) that can exhaust system resources.
Bash Commands and Code:
Vulnerable Command:
oras discover attacker.local/repo@sha256:<A>
This command triggers the vulnerable recursive traversal. If the registry returns a cyclic graph, the command will hang indefinitely, consuming CPU and memory.
Proof of Concept (PoC) Setup:
A malicious registry can be set up to return the following referrer relationships:
– `referrers(A) = [bash]` (self-loop)
– Or: `referrers(A) = [bash]` and `referrers(B) = [bash]` (two-node cycle)
Exploit: (Educational Purposes!)
To exploit this vulnerability, an attacker would need to control an OCI registry. They would craft the registry’s response to the ORAS CLI’s referrer API requests to include a cyclic graph. When a user runs `oras discover` against this malicious registry, the ORAS CLI will enter an infinite loop, leading to a Denial of Service. This can be used to disrupt CI/CD pipelines or other automated processes that rely on ORAS.
Protection:
The primary protection is to upgrade to ORAS version 1.3.3 or later. This version includes the necessary cycle detection to prevent unbounded recursion. If upgrading is not immediately possible, avoid using `oras discover` with the default `–depth` setting (which is unlimited) against untrusted registries. However, this is not a complete mitigation, as the backup and restore workflows are also vulnerable.
Impact:
- Excessive CPU utilization
- Excessive memory consumption
- Unbounded recursion
- Hung CI/CD jobs
- Stalled automation pipelines
- Failed backup or discovery operations
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
