{"schema_version":"2","view":"grouped","data":[{"id":70957,"cve_ids":["CVE-2026-85731","CVE-2026-85732"],"payload":{"kind":"advisory","title":"Security update for helm","summary":"This update for helm fixes the following issues: - CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (bsc#1281104). - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112). Changes for helm: - Update to version 3.22.0: * chore(deps): bump the k8s-io group across 1 directory with 6 updates * bump version to 3.22 (#32606) * fix: set [pull,push] scope when helm push to a registry(use token auth) (backport) (#32362) * chore(deps): bump the k8s-io group with 7 updates (#32573) * chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#32563) * chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#32554) * chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#32542) * [dev-v3 backport] deps: bump google.golang.org/grpc@v1.82.1 for GO-2026-6061 (#32536) * fix: bump go.opentelemetry.io/otel@v1.44.0 for GO-2026-5158 (#32535) * chore(deps): bump github.com/santhosh-tekuri/jsonschema/v6 * fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932 * chore(deps): bump the k8s-io group with 7 updates * chore(deps): bump github/codeql-action/upload-sarif (#32449) * chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.2 * chore(deps): bump github/codeql-action/autobuild from 4.37.1 to 4.37.2 * chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.2 * chore(d","evidence":"osv:SUSE-SU-2026:4417-1","products":[{"name":{"value":"helm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/5/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/6/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/7/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/7/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/8/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/8/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/9/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/9/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/10/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/10/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/11/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/11/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/12/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/12/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4417-1","aliases":["SUSE-SU-2026:4417-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Micro%205.5","ecosystem":"SUSE:Linux Enterprise Micro 5.5"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Containers%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm-fish-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}}],"modified":"2026-10-02T18:30:38.457958645Z","provider":"osv","upstream":["CVE-2026-85731","CVE-2026-85732"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264417-1/","https://bugzilla.suse.com/1281104","https://bugzilla.suse.com/1281112","https://www.suse.com/security/cve/CVE-2026-85731","https://www.suse.com/security/cve/CVE-2026-85732"]},"related_cves":[{"value":"CVE-2026-85731","evidence":"/upstream"},{"value":"CVE-2026-85732","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:03237c51-9d40-4d67-be46-7406c5c2b0b1","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-85731","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"products":[{"name":{"value":"oras.land/oras-go/v2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-m37j-52j7-pjw7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4417-1","advisory_id":"03237c51-9d40-4d67-be46-7406c5c2b0b1","event_types":["advisory"],"published_at":"2026-10-25T22:45:36.224698+00:00","technologies":["core-osv","helm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T09:20:18+00:00","detail_url":"/advisories/advisory%3A03237c51-9d40-4d67-be46-7406c5c2b0b1","group":{"id":"advisory:03237c51-9d40-4d67-be46-7406c5c2b0b1","revision":1,"primary_event_id":71328,"change":"published","superseded_by":[],"changed":{"id":71328,"cve_ids":["CVE-2026-85731","CVE-2026-85732"],"payload":{"kind":"advisory","title":"Security update for helm","summary":"This update for helm fixes the following issues: - CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (bsc#1281104). - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112). Changes for helm: - Update to version 3.22.0: * chore(deps): bump the k8s-io group across 1 directory with 6 updates * bump version to 3.22 (#32606) * fix: set [pull,push] scope when helm push to a registry(use token auth) (backport) (#32362) * chore(deps): bump the k8s-io group with 7 updates (#32573) * chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#32563) * chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#32554) * chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#32542) * [dev-v3 backport] deps: bump google.golang.org/grpc@v1.82.1 for GO-2026-6061 (#32536) * fix: bump go.opentelemetry.io/otel@v1.44.0 for GO-2026-5158 (#32535) * chore(deps): bump github.com/santhosh-tekuri/jsonschema/v6 * fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932 * chore(deps): bump the k8s-io group with 7 updates * chore(deps): bump github/codeql-action/upload-sarif (#32449) * chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.2 * chore(deps): bump github/codeql-action/autobuild from 4.37.1 to 4.37.2 * chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.2 * chore(d","evidence":"osv:SUSE-SU-2026:4417-1","products":[{"name":{"value":"helm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/5/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/6/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/7/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/7/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/8/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/8/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/9/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/9/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/10/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/10/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/11/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/11/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/12/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/12/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4417-1","aliases":["SUSE-SU-2026:4417-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Micro%205.5","ecosystem":"SUSE:Linux Enterprise Micro 5.5"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Containers%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm-fish-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}}],"modified":"2026-10-02T18:30:38.457958645Z","provider":"osv","upstream":["CVE-2026-85731","CVE-2026-85732"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264417-1/","https://bugzilla.suse.com/1281104","https://bugzilla.suse.com/1281112","https://www.suse.com/security/cve/CVE-2026-85731","https://www.suse.com/security/cve/CVE-2026-85732"]},"related_cves":[{"value":"CVE-2026-85731","evidence":"/upstream"},{"value":"CVE-2026-85732","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:03237c51-9d40-4d67-be46-7406c5c2b0b1","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-85731","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"products":[{"name":{"value":"oras.land/oras-go/v2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-m37j-52j7-pjw7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4417-1","advisory_id":"03237c51-9d40-4d67-be46-7406c5c2b0b1","event_types":["advisory"],"published_at":"2026-10-25T22:45:36.224698+00:00","technologies":["core-osv","helm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T09:20:18+00:00","detail_url":"/events/71328"},"members":[{"id":71328,"cve_ids":["CVE-2026-85731","CVE-2026-85732"],"payload":{"kind":"advisory","title":"Security update for helm","summary":"This update for helm fixes the following issues: - CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (bsc#1281104). - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112). Changes for helm: - Update to version 3.22.0: * chore(deps): bump the k8s-io group across 1 directory with 6 updates * bump version to 3.22 (#32606) * fix: set [pull,push] scope when helm push to a registry(use token auth) (backport) (#32362) * chore(deps): bump the k8s-io group with 7 updates (#32573) * chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#32563) * chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#32554) * chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#32542) * [dev-v3 backport] deps: bump google.golang.org/grpc@v1.82.1 for GO-2026-6061 (#32536) * fix: bump go.opentelemetry.io/otel@v1.44.0 for GO-2026-5158 (#32535) * chore(deps): bump github.com/santhosh-tekuri/jsonschema/v6 * fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932 * chore(deps): bump the k8s-io group with 7 updates * chore(deps): bump github/codeql-action/upload-sarif (#32449) * chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.2 * chore(deps): bump github/codeql-action/autobuild from 4.37.1 to 4.37.2 * chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.2 * chore(d","evidence":"osv:SUSE-SU-2026:4417-1","products":[{"name":{"value":"helm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/5/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/6/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/7/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/7/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/8/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/8/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/9/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/9/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/10/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/10/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/11/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/11/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/12/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/12/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4417-1","aliases":["SUSE-SU-2026:4417-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Micro%205.5","ecosystem":"SUSE:Linux Enterprise Micro 5.5"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Containers%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm-fish-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}}],"modified":"2026-10-02T18:30:38.457958645Z","provider":"osv","upstream":["CVE-2026-85731","CVE-2026-85732"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264417-1/","https://bugzilla.suse.com/1281104","https://bugzilla.suse.com/1281112","https://www.suse.com/security/cve/CVE-2026-85731","https://www.suse.com/security/cve/CVE-2026-85732"]},"related_cves":[{"value":"CVE-2026-85731","evidence":"/upstream"},{"value":"CVE-2026-85732","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:03237c51-9d40-4d67-be46-7406c5c2b0b1","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-85731","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"products":[{"name":{"value":"oras.land/oras-go/v2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-m37j-52j7-pjw7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4417-1","advisory_id":"03237c51-9d40-4d67-be46-7406c5c2b0b1","event_types":["advisory"],"published_at":"2026-10-25T22:45:36.224698+00:00","technologies":["core-osv","helm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T09:20:18+00:00","detail_url":"/events/71328"}]}},{"id":64600,"cve_ids":["CVE-2026-85731"],"payload":{"kind":"advisory","title":"oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)","summary":"### Summary The `content/file.Store` in oras-go v2 unpacks OCI layer tarballs when a descriptor carries `io.deis.oras.content.unpack=true`. The extraction routine validates symlink targets purely lexically (`filepath.Join`) and, for regular files placed directly at the extraction root, skips the parent-symlink `Lstat` walk. A malicious tarball can plant a chain of symlinks whose lexical target stays inside the extraction root but whose kernel-resolved target is any absolute path, then write through it with a follow-up regular-file entry. The result is arbitrary file create/overwrite outside the store's working directory under the default `AllowPathTraversalOnWrite=false` configuration — a canonical tar-slip → RCE primitive. ### Details **Affected versions:** `<= v2.6.1` **Entry point:** `content/file/file.go` line 486, `(*Store).pushDir` — reached from `(*Store).Push` for any descriptor whose annotations include `io.deis.oras.content.unpack: \"true\"` (i.e. `file.AnnotationUnpack`) and an `org.opencontainers.image.title`. `oras.Copy` from a remote registry into a `file.New(dir)` store invokes this per layer. **Root cause 1 — lexical link validation.** `content/file/utils.go` lines 264–275, `ensureLinkPath`: ```go func ensureLinkPath(baseAbs, baseRel, link, target string) (string, error) { // resolve link path := target if !filepath.IsAbs(target) { path = filepath.Join(filepath.Dir(link), target) } // ensure path is under baseAbs or baseRel if _, err := resolveRelToBase(baseAbs,","evidence":"osv:GHSA-m37j-52j7-pjw7","products":[{"name":{"value":"oras.land/oras-go/v2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"GHSA-m37j-52j7-pjw7","aliases":["CVE-2026-85731","GHSA-m37j-52j7-pjw7","GO-2026-6499"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.2"}]}],"package":{"name":"oras.land/oras-go/v2","purl":"pkg:golang/oras.land/oras-go/v2","ecosystem":"Go"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-m37j-52j7-pjw7/GHSA-m37j-52j7-pjw7.json","last_known_affected_version_range":"<= 2.6.1"}}],"modified":"2026-10-01T20:55:50.398664561Z","provider":"osv","references":["https://github.com/oras-project/oras-go/security/advisories/GHSA-m37j-52j7-pjw7","https://nvd.nist.gov/vuln/detail/CVE-2026-85731","https://github.com/oras-project/oras-go/commit/adab2f25ea95ef4e6e41f50db9266a6701399422","https://github.com/oras-project/oras-go","https://github.com/oras-project/oras-go/releases/tag/v2.6.2"],"provider_metadata":{"cwe_ids":["CWE-22","CWE-59"],"severity":"HIGH","github_reviewed":true,"nvd_published_at":"2026-09-16T17:18:15Z","github_reviewed_at":"2026-09-17T17:15:57Z"}},"related_cves":[{"value":"CVE-2026-85731","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"osv:GHSA-m37j-52j7-pjw7","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-m37j-52j7-pjw7","advisory_id":"b0f4ccfc-4c3e-4f16-ba23-10338ba4d927","event_types":["advisory"],"published_at":"2026-10-25T19:52:20.897326+00:00","technologies":["core-osv","oras-land-oras-go-v2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-17T17:15:57+00:00","detail_url":"/advisories/osv%3AGHSA-m37j-52j7-pjw7","group":{"id":"osv:GHSA-m37j-52j7-pjw7","revision":1,"primary_event_id":63902,"change":"published","superseded_by":[],"changed":{"id":63902,"cve_ids":["CVE-2026-85731"],"payload":{"kind":"advisory","title":"oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)","summary":"### Summary The `content/file.Store` in oras-go v2 unpacks OCI layer tarballs when a descriptor carries `io.deis.oras.content.unpack=true`. The extraction routine validates symlink targets purely lexically (`filepath.Join`) and, for regular files placed directly at the extraction root, skips the parent-symlink `Lstat` walk. A malicious tarball can plant a chain of symlinks whose lexical target stays inside the extraction root but whose kernel-resolved target is any absolute path, then write through it with a follow-up regular-file entry. The result is arbitrary file create/overwrite outside the store's working directory under the default `AllowPathTraversalOnWrite=false` configuration — a canonical tar-slip → RCE primitive. ### Details **Affected versions:** `<= v2.6.1` **Entry point:** `content/file/file.go` line 486, `(*Store).pushDir` — reached from `(*Store).Push` for any descriptor whose annotations include `io.deis.oras.content.unpack: \"true\"` (i.e. `file.AnnotationUnpack`) and an `org.opencontainers.image.title`. `oras.Copy` from a remote registry into a `file.New(dir)` store invokes this per layer. **Root cause 1 — lexical link validation.** `content/file/utils.go` lines 264–275, `ensureLinkPath`: ```go func ensureLinkPath(baseAbs, baseRel, link, target string) (string, error) { // resolve link path := target if !filepath.IsAbs(target) { path = filepath.Join(filepath.Dir(link), target) } // ensure path is under baseAbs or baseRel if _, err := resolveRelToBase(baseAbs,","evidence":"osv:GHSA-m37j-52j7-pjw7","products":[{"name":{"value":"oras.land/oras-go/v2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"GHSA-m37j-52j7-pjw7","aliases":["CVE-2026-85731","GHSA-m37j-52j7-pjw7","GO-2026-6499"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.2"}]}],"package":{"name":"oras.land/oras-go/v2","purl":"pkg:golang/oras.land/oras-go/v2","ecosystem":"Go"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-m37j-52j7-pjw7/GHSA-m37j-52j7-pjw7.json","last_known_affected_version_range":"<= 2.6.1"}}],"modified":"2026-10-01T20:55:50.398664561Z","provider":"osv","references":["https://github.com/oras-project/oras-go/security/advisories/GHSA-m37j-52j7-pjw7","https://nvd.nist.gov/vuln/detail/CVE-2026-85731","https://github.com/oras-project/oras-go/commit/adab2f25ea95ef4e6e41f50db9266a6701399422","https://github.com/oras-project/oras-go","https://github.com/oras-project/oras-go/releases/tag/v2.6.2"],"provider_metadata":{"cwe_ids":["CWE-22","CWE-59"],"severity":"HIGH","github_reviewed":true,"nvd_published_at":"2026-09-16T17:18:15Z","github_reviewed_at":"2026-09-17T17:15:57Z"}},"related_cves":[{"value":"CVE-2026-85731","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"osv:GHSA-m37j-52j7-pjw7","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-m37j-52j7-pjw7","advisory_id":"b0f4ccfc-4c3e-4f16-ba23-10338ba4d927","event_types":["advisory"],"published_at":"2026-10-25T19:52:20.897326+00:00","technologies":["core-osv","oras-land-oras-go-v2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-17T17:15:57+00:00","detail_url":"/events/63902"},"members":[{"id":63902,"cve_ids":["CVE-2026-85731"],"payload":{"kind":"advisory","title":"oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)","summary":"### Summary The `content/file.Store` in oras-go v2 unpacks OCI layer tarballs when a descriptor carries `io.deis.oras.content.unpack=true`. The extraction routine validates symlink targets purely lexically (`filepath.Join`) and, for regular files placed directly at the extraction root, skips the parent-symlink `Lstat` walk. A malicious tarball can plant a chain of symlinks whose lexical target stays inside the extraction root but whose kernel-resolved target is any absolute path, then write through it with a follow-up regular-file entry. The result is arbitrary file create/overwrite outside the store's working directory under the default `AllowPathTraversalOnWrite=false` configuration — a canonical tar-slip → RCE primitive. ### Details **Affected versions:** `<= v2.6.1` **Entry point:** `content/file/file.go` line 486, `(*Store).pushDir` — reached from `(*Store).Push` for any descriptor whose annotations include `io.deis.oras.content.unpack: \"true\"` (i.e. `file.AnnotationUnpack`) and an `org.opencontainers.image.title`. `oras.Copy` from a remote registry into a `file.New(dir)` store invokes this per layer. **Root cause 1 — lexical link validation.** `content/file/utils.go` lines 264–275, `ensureLinkPath`: ```go func ensureLinkPath(baseAbs, baseRel, link, target string) (string, error) { // resolve link path := target if !filepath.IsAbs(target) { path = filepath.Join(filepath.Dir(link), target) } // ensure path is under baseAbs or baseRel if _, err := resolveRelToBase(baseAbs,","evidence":"osv:GHSA-m37j-52j7-pjw7","products":[{"name":{"value":"oras.land/oras-go/v2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"GHSA-m37j-52j7-pjw7","aliases":["CVE-2026-85731","GHSA-m37j-52j7-pjw7","GO-2026-6499"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.2"}]}],"package":{"name":"oras.land/oras-go/v2","purl":"pkg:golang/oras.land/oras-go/v2","ecosystem":"Go"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-m37j-52j7-pjw7/GHSA-m37j-52j7-pjw7.json","last_known_affected_version_range":"<= 2.6.1"}}],"modified":"2026-10-01T20:55:50.398664561Z","provider":"osv","references":["https://github.com/oras-project/oras-go/security/advisories/GHSA-m37j-52j7-pjw7","https://nvd.nist.gov/vuln/detail/CVE-2026-85731","https://github.com/oras-project/oras-go/commit/adab2f25ea95ef4e6e41f50db9266a6701399422","https://github.com/oras-project/oras-go","https://github.com/oras-project/oras-go/releases/tag/v2.6.2"],"provider_metadata":{"cwe_ids":["CWE-22","CWE-59"],"severity":"HIGH","github_reviewed":true,"nvd_published_at":"2026-09-16T17:18:15Z","github_reviewed_at":"2026-09-17T17:15:57Z"}},"related_cves":[{"value":"CVE-2026-85731","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"osv:GHSA-m37j-52j7-pjw7","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-m37j-52j7-pjw7","advisory_id":"b0f4ccfc-4c3e-4f16-ba23-10338ba4d927","event_types":["advisory"],"published_at":"2026-10-25T19:52:20.897326+00:00","technologies":["core-osv","oras-land-oras-go-v2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-17T17:15:57+00:00","detail_url":"/events/63902"},{"id":63903,"cve_ids":["CVE-2026-85731"],"payload":{"kind":"advisory","title":"Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go","summary":"Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go","evidence":"osv:GO-2026-6499","products":[{"name":{"value":"oras.land/oras-go/v2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"GO-2026-6499","aliases":["CVE-2026-85731","GHSA-m37j-52j7-pjw7","GO-2026-6499"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.2"}]}],"package":{"name":"oras.land/oras-go/v2","purl":"pkg:golang/oras.land/oras-go/v2","ecosystem":"Go"},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6499.json"},"ecosystem_specific":{}}],"modified":"2026-10-01T20:45:12.176535928Z","provider":"osv","references":["https://github.com/oras-project/oras-go/security/advisories/GHSA-m37j-52j7-pjw7","https://github.com/oras-project/oras-go/commit/adab2f25ea95ef4e6e41f50db9266a6701399422","https://github.com/oras-project/oras-go/releases/tag/v2.6.2"],"provider_metadata":{"url":"https://pkg.go.dev/vuln/GO-2026-6499","review_status":"REVIEWED"}},"related_cves":[{"value":"CVE-2026-85731","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":null},"group_id":"osv:GHSA-m37j-52j7-pjw7","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-85731","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"products":[{"name":{"value":"oras.land/oras-go/v2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-m37j-52j7-pjw7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GO-2026-6499","advisory_id":"d2657c70-16b8-4197-a399-0e1e7561c17d","event_types":["advisory"],"published_at":"2026-10-25T19:52:20.897326+00:00","technologies":["core-osv","oras-land-oras-go-v2"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-10-01T20:23:52+00:00","detail_url":"/events/63903"}]}}],"next_after":70957,"next_before":64600}