Please follow the security policy to report a security vulnerability or concern.
Repository navigation
Security: oras-project/oras
Security
SECURITY.md
-
Debug HTTP traces expose replayable bearer credentialsGHSA-5jhf-2qmf-m8c5 published
Sep 21, 2026 by TerryHoweModerate -
Registry custom credentials are forwarded across HTTP originsGHSA-whvf-jp7m-59f3 published
Sep 21, 2026 by TerryHoweModerate -
Registry mTLS client certificates are disclosed to cross-origin TLS peersGHSA-h3wm-jjqf-8jm2 published
Sep 21, 2026 by TerryHoweModerate -
Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption in the ORAS CLIGHSA-298f-872v-2rcx published
Aug 1, 2026 by TerryHoweLow -
Attacker-controlled OCI descriptor size causes unrecovered panic and process crash in ORAS CLIGHSA-f36w-mj3v-6jqv published
Jul 24, 2026 by TerryHoweModerate -
Tarballs with links can escape working directory upon extraction ("zip slip")GHSA-g5v4-5x39-vwhx published
Jan 22, 2021 by jdolitskyHigh
Learn more about advisories related to oras-project/oras in the GitHub Advisory Database