ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded recursion and memory growth. This affects oras discover, whose recursive traversal is enabled by default because the --depth option defaults to 0 (unlimited), as well as the recursive referrer counting used by the oras backup and oras restore workflows. A cyclic graph can be as simple as A referring to B and B referring back to A. A malicious registry can use this to cause a client-side denial of service, exhausting CPU and memory and hanging automation or CI/CD pipelines that run ORAS against untrusted registry metadata. The vulnerability does not extend to code execution, artifact substitution, or integrity bypass. This issue has been fixed in version 1.3.3.

Affected: Go: oras.land/oras

### Summary

A malicious OCI registry can return a **cyclic referrer graph** (e.g. `A -> A` or `A -> B -> A`). The ORAS CLI's recursive referrer traversal does not track visited descriptors, so a cycle causes unbounded recursion and memory growth — a client-side denial of service.

This affects `oras discover` (recursive referrer traversal) and the recursive referrer counting used by `oras backup` and `oras restore`. Because `oras discover --depth` defaults to `0` (unlimited), `discover` is affected out of the box.

> **Note:** This advisory covers only the **ORAS CLI** (`oras.land/oras`). The related Referrers API pagination loop in the `oras-go` library is tracked in a separate advisory on the [oras-go](https://github.com/oras-project/oras-go) repository.

### Details

In `oras discover`, recursive referrer traversal follows discovered referrers without maintaining a visited-descriptor set.

Simplified flow:

```text runDiscover -> fetchAllReferrers(root) -> registry.Referrers(root) -> for each referrer: fetchAllReferrers(referrer) ```

A malicious registry can create cyclic graphs such as:

```text A -> A ```

or

```text A -> B -> A ```

Because traversal does not track previously visited descriptors, recursion never reaches a terminating condition.

Similarly, the recursive counting logic (`graph.RecursiveFindReferrers`, used by the `backup` and `restore` workflows) accumulates descriptors without cycle detection, causing unbounded memory growth.…

Affected: Ubuntu:Pro:26.04:LTS: oras

ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded recursion and memory growth. This affects oras discover, whose recursive traversal is enabled by default because the --depth option defaults to 0 (unlimited), as well as the recursive referrer counting used by the oras backup and oras restore workflows. A cyclic graph can be as simple as A referring to B and B referring back to A. A malicious registry can use this to cause a client-side denial of service, exhausting CPU and memory and hanging automation or CI/CD pipelines that run ORAS against untrusted registry metadata. The vulnerability does not extend to code execution, artifact substitution, or integrity bypass. This issue has been fixed in version 1.3.3.