CVE-2026-55588

Low

Advisory

Published 28 Aug 2026In the index since 9 Sept 2026

ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption

Carried by container images the latest versions of 2 of 17,781 indexed charts deploy, on 2 images.

Affected package	Affected versions	Fixed in	Images
oras.land/orasgolang	v1.0.0, v1.3.2	1.3.3	2

2 by stars

Chart

Latest

Affected images

Radar Score

1 of the 2 container images this version deploys carry CVE-2026-55588.

Container image	Digest	Package	Fixed in
registry.gitlab.com/xrow-public/helm-openclaw/openclaw :1.91.3	ed44d81a65de	oras.land/oras@v1.3.2	1.3.3

2,977

scannerappscode

1 of the 3 container images this version deploys carry CVE-2026-55588.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/trivydb :0.0.3	67ffb0309acb	oras.land/oras@v1.0.0	1.3.3

5,299

2 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/appscode/trivydb :0.0.3	67ffb0309acb	oras.land/oras@v1.0.0	1.3.3	1
registry.gitlab.com/xrow-public/helm-openclaw/openclaw :1.91.3	ed44d81a65de	oras.land/oras@v1.3.2	1.3.3	1