This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-50151 →

DEBIAN-CVE-2026-50151

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a...

Original description

The description as published by the source.

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:13 golang-oras-oras-go

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 golang-oras-oras-go

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-1"}]}]

References

advisory security-tracker.debian.org