GO-2026-5882
Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go
At a glance
- Published
- Updated
- CVE
- CVE-2026-50151
- Aliases
- GHSA-jxpm-75mh-9fp7
Description
Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go
Affected packages
| Package | Versions |
|---|---|
| Go · oras.land/oras-go/v2 | introduced 0, fixed 2.6.1 |
References
- https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7 ADVISORY
- https://github.com/oras-project/oras-go/commit/4683c46ef078091544f5f55fd25102f002806991 FIX
- https://github.com/oras-project/oras-go/pull/1152 FIX
- https://github.com/oras-project/oras-go/releases/tag/v2.6.1 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |