{"schema_version":"2","view":"grouped","data":[{"id":70957,"cve_ids":["CVE-2026-85731","CVE-2026-85732"],"payload":{"kind":"advisory","title":"Security update for helm","summary":"This update for helm fixes the following issues: - CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (bsc#1281104). - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112). Changes for helm: - Update to version 3.22.0: * chore(deps): bump the k8s-io group across 1 directory with 6 updates * bump version to 3.22 (#32606) * fix: set [pull,push] scope when helm push to a registry(use token auth) (backport) (#32362) * chore(deps): bump the k8s-io group with 7 updates (#32573) * chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#32563) * chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#32554) * chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#32542) * [dev-v3 backport] deps: bump google.golang.org/grpc@v1.82.1 for GO-2026-6061 (#32536) * fix: bump go.opentelemetry.io/otel@v1.44.0 for GO-2026-5158 (#32535) * chore(deps): bump github.com/santhosh-tekuri/jsonschema/v6 * fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932 * chore(deps): bump the k8s-io group with 7 updates * chore(deps): bump github/codeql-action/upload-sarif (#32449) * chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.2 * chore(deps): bump github/codeql-action/autobuild from 4.37.1 to 4.37.2 * chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.2 * chore(d","evidence":"osv:SUSE-SU-2026:4417-1","products":[{"name":{"value":"helm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/5/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/6/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/7/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/7/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/8/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/8/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/9/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/9/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/10/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/10/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/11/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/11/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/12/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/12/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4417-1","aliases":["SUSE-SU-2026:4417-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Micro%205.5","ecosystem":"SUSE:Linux Enterprise Micro 5.5"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Containers%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm-fish-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}}],"modified":"2026-10-02T18:30:38.457958645Z","provider":"osv","upstream":["CVE-2026-85731","CVE-2026-85732"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264417-1/","https://bugzilla.suse.com/1281104","https://bugzilla.suse.com/1281112","https://www.suse.com/security/cve/CVE-2026-85731","https://www.suse.com/security/cve/CVE-2026-85732"]},"related_cves":[{"value":"CVE-2026-85731","evidence":"/upstream"},{"value":"CVE-2026-85732","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:03237c51-9d40-4d67-be46-7406c5c2b0b1","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-85731","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"products":[{"name":{"value":"oras.land/oras-go/v2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-m37j-52j7-pjw7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4417-1","advisory_id":"03237c51-9d40-4d67-be46-7406c5c2b0b1","event_types":["advisory"],"published_at":"2026-10-25T22:45:36.224698+00:00","technologies":["core-osv","helm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T09:20:18+00:00","detail_url":"/advisories/advisory%3A03237c51-9d40-4d67-be46-7406c5c2b0b1","group":{"id":"advisory:03237c51-9d40-4d67-be46-7406c5c2b0b1","revision":1,"primary_event_id":71328,"change":"published","superseded_by":[],"changed":{"id":71328,"cve_ids":["CVE-2026-85731","CVE-2026-85732"],"payload":{"kind":"advisory","title":"Security update for helm","summary":"This update for helm fixes the following issues: - CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (bsc#1281104). - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112). Changes for helm: - Update to version 3.22.0: * chore(deps): bump the k8s-io group across 1 directory with 6 updates * bump version to 3.22 (#32606) * fix: set [pull,push] scope when helm push to a registry(use token auth) (backport) (#32362) * chore(deps): bump the k8s-io group with 7 updates (#32573) * chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#32563) * chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#32554) * chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#32542) * [dev-v3 backport] deps: bump google.golang.org/grpc@v1.82.1 for GO-2026-6061 (#32536) * fix: bump go.opentelemetry.io/otel@v1.44.0 for GO-2026-5158 (#32535) * chore(deps): bump github.com/santhosh-tekuri/jsonschema/v6 * fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932 * chore(deps): bump the k8s-io group with 7 updates * chore(deps): bump github/codeql-action/upload-sarif (#32449) * chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.2 * chore(deps): bump github/codeql-action/autobuild from 4.37.1 to 4.37.2 * chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.2 * chore(d","evidence":"osv:SUSE-SU-2026:4417-1","products":[{"name":{"value":"helm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/5/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/6/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/7/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/7/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/8/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/8/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/9/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/9/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/10/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/10/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/11/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/11/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/12/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/12/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4417-1","aliases":["SUSE-SU-2026:4417-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Micro%205.5","ecosystem":"SUSE:Linux Enterprise Micro 5.5"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Containers%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm-fish-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}}],"modified":"2026-10-02T18:30:38.457958645Z","provider":"osv","upstream":["CVE-2026-85731","CVE-2026-85732"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264417-1/","https://bugzilla.suse.com/1281104","https://bugzilla.suse.com/1281112","https://www.suse.com/security/cve/CVE-2026-85731","https://www.suse.com/security/cve/CVE-2026-85732"]},"related_cves":[{"value":"CVE-2026-85731","evidence":"/upstream"},{"value":"CVE-2026-85732","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:03237c51-9d40-4d67-be46-7406c5c2b0b1","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-85731","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"products":[{"name":{"value":"oras.land/oras-go/v2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-m37j-52j7-pjw7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4417-1","advisory_id":"03237c51-9d40-4d67-be46-7406c5c2b0b1","event_types":["advisory"],"published_at":"2026-10-25T22:45:36.224698+00:00","technologies":["core-osv","helm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T09:20:18+00:00","detail_url":"/events/71328"},"members":[{"id":71328,"cve_ids":["CVE-2026-85731","CVE-2026-85732"],"payload":{"kind":"advisory","title":"Security update for helm","summary":"This update for helm fixes the following issues: - CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (bsc#1281104). - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112). Changes for helm: - Update to version 3.22.0: * chore(deps): bump the k8s-io group across 1 directory with 6 updates * bump version to 3.22 (#32606) * fix: set [pull,push] scope when helm push to a registry(use token auth) (backport) (#32362) * chore(deps): bump the k8s-io group with 7 updates (#32573) * chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#32563) * chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#32554) * chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#32542) * [dev-v3 backport] deps: bump google.golang.org/grpc@v1.82.1 for GO-2026-6061 (#32536) * fix: bump go.opentelemetry.io/otel@v1.44.0 for GO-2026-5158 (#32535) * chore(deps): bump github.com/santhosh-tekuri/jsonschema/v6 * fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932 * chore(deps): bump the k8s-io group with 7 updates * chore(deps): bump github/codeql-action/upload-sarif (#32449) * chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.2 * chore(deps): bump github/codeql-action/autobuild from 4.37.1 to 4.37.2 * chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.2 * chore(d","evidence":"osv:SUSE-SU-2026:4417-1","products":[{"name":{"value":"helm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/5/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/6/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/7/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/7/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/8/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/8/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/9/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/9/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/10/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/10/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/11/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/11/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/12/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/12/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4417-1","aliases":["SUSE-SU-2026:4417-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Micro%205.5","ecosystem":"SUSE:Linux Enterprise Micro 5.5"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Containers%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm-fish-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}}],"modified":"2026-10-02T18:30:38.457958645Z","provider":"osv","upstream":["CVE-2026-85731","CVE-2026-85732"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264417-1/","https://bugzilla.suse.com/1281104","https://bugzilla.suse.com/1281112","https://www.suse.com/security/cve/CVE-2026-85731","https://www.suse.com/security/cve/CVE-2026-85732"]},"related_cves":[{"value":"CVE-2026-85731","evidence":"/upstream"},{"value":"CVE-2026-85732","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:03237c51-9d40-4d67-be46-7406c5c2b0b1","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-85731","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"products":[{"name":{"value":"oras.land/oras-go/v2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-m37j-52j7-pjw7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4417-1","advisory_id":"03237c51-9d40-4d67-be46-7406c5c2b0b1","event_types":["advisory"],"published_at":"2026-10-25T22:45:36.224698+00:00","technologies":["core-osv","helm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T09:20:18+00:00","detail_url":"/events/71328"}]}},{"id":64554,"cve_ids":["CVE-2026-85732"],"payload":{"kind":"advisory","title":"oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing","summary":"## Summary oras-go's pagination helper `parseLink()` in `registry/remote/utils.go` follows the `Link` response header from a registry without validating the URL's host or scheme. When a malicious registry returns a `Link` header containing an absolute URL pointing to an arbitrary host (e.g., a cloud metadata endpoint), the client makes GET requests to that host from the victim's network. This affects all pagination-based listing operations: Tags, Referrers, and Repositories (catalog). ## Root Cause `parseLink()` at `registry/remote/utils.go:54` calls `resp.Request.URL.Parse(link)` which, for absolute URLs, returns the absolute URL unchanged. The result is passed directly to the next pagination loop iteration where `http.NewRequestWithContext()` creates a GET request to the attacker-specified URL. No host comparison, scheme validation, or IP filtering exists between `parseLink` output and the HTTP request. ## Affected Code Paths - `registry/remote/repository.go:Tags()` calls `parseLink()` for next page URL - `registry/remote/repository.go:Referrers()` calls `parseLink()` for next page URL - `registry/remote/registry.go:Repositories()` calls `parseLink()` for next page URL ## Impact **Blind SSRF from the victim's network.** A malicious registry operator can force any oras-go client that lists tags, referrers, or repositories to issue GET requests to arbitrary internal endpoints: - Cloud instance metadata endpoints for service discovery and IAM role enumeration - Internal HTTP s","evidence":"osv:GHSA-h7vf-4x9w-h99v","products":[{"name":{"value":"oras.land/oras-go/v2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"GHSA-h7vf-4x9w-h99v","aliases":["CVE-2026-85732","GHSA-h7vf-4x9w-h99v","GO-2026-6497"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.2"}]}],"package":{"name":"oras.land/oras-go/v2","purl":"pkg:golang/oras.land/oras-go/v2","ecosystem":"Go"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-h7vf-4x9w-h99v/GHSA-h7vf-4x9w-h99v.json","last_known_affected_version_range":"<= 2.6.1"}}],"modified":"2026-10-01T20:55:52.275640599Z","provider":"osv","references":["https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v","https://nvd.nist.gov/vuln/detail/CVE-2026-85732","https://github.com/oras-project/oras-go/commit/31da1963f8c327dd089cd29faeae95cf0fc50842","https://github.com/oras-project/oras-go","https://github.com/oras-project/oras-go/releases/tag/v2.6.2"],"provider_metadata":{"cwe_ids":["CWE-918"],"severity":"MODERATE","github_reviewed":true,"nvd_published_at":"2026-09-16T17:18:16Z","github_reviewed_at":"2026-09-17T17:16:02Z"}},"related_cves":[{"value":"CVE-2026-85732","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":null},"group_id":"osv:GHSA-h7vf-4x9w-h99v","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-h7vf-4x9w-h99v","advisory_id":"ee493bad-3d49-4f96-b94a-98f626d41b8b","event_types":["advisory"],"published_at":"2026-10-25T19:52:24.157085+00:00","technologies":["core-osv","oras-land-oras-go-v2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-17T17:16:02+00:00","detail_url":"/advisories/osv%3AGHSA-h7vf-4x9w-h99v","group":{"id":"osv:GHSA-h7vf-4x9w-h99v","revision":1,"primary_event_id":63907,"change":"published","superseded_by":[],"changed":{"id":63825,"cve_ids":["CVE-2026-85732"],"payload":{"kind":"advisory","title":"Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go","summary":"Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go","evidence":"osv:GO-2026-6497","products":[{"name":{"value":"oras.land/oras-go/v2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"GO-2026-6497","aliases":["CVE-2026-85732","GHSA-h7vf-4x9w-h99v","GO-2026-6497"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.2"}]}],"package":{"name":"oras.land/oras-go/v2","purl":"pkg:golang/oras.land/oras-go/v2","ecosystem":"Go"},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6497.json"},"ecosystem_specific":{}}],"modified":"2026-10-01T20:45:12.219872881Z","provider":"osv","references":["https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v","https://github.com/oras-project/oras-go/commit/31da1963f8c327dd089cd29faeae95cf0fc50842","https://github.com/oras-project/oras-go/releases/tag/v2.6.2"],"provider_metadata":{"url":"https://pkg.go.dev/vuln/GO-2026-6497","review_status":"REVIEWED"}},"related_cves":[{"value":"CVE-2026-85732","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":null},"group_id":"osv:GHSA-h7vf-4x9w-h99v","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GO-2026-6497","advisory_id":"4e19a323-87f2-461d-8a0f-29ff241546f0","event_types":["advisory"],"published_at":"2026-10-25T19:51:33.888886+00:00","technologies":["core-osv","oras-land-oras-go-v2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T20:23:47+00:00","detail_url":"/events/63825"},"members":[{"id":63825,"cve_ids":["CVE-2026-85732"],"payload":{"kind":"advisory","title":"Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go","summary":"Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go","evidence":"osv:GO-2026-6497","products":[{"name":{"value":"oras.land/oras-go/v2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"GO-2026-6497","aliases":["CVE-2026-85732","GHSA-h7vf-4x9w-h99v","GO-2026-6497"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.2"}]}],"package":{"name":"oras.land/oras-go/v2","purl":"pkg:golang/oras.land/oras-go/v2","ecosystem":"Go"},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6497.json"},"ecosystem_specific":{}}],"modified":"2026-10-01T20:45:12.219872881Z","provider":"osv","references":["https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v","https://github.com/oras-project/oras-go/commit/31da1963f8c327dd089cd29faeae95cf0fc50842","https://github.com/oras-project/oras-go/releases/tag/v2.6.2"],"provider_metadata":{"url":"https://pkg.go.dev/vuln/GO-2026-6497","review_status":"REVIEWED"}},"related_cves":[{"value":"CVE-2026-85732","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":null},"group_id":"osv:GHSA-h7vf-4x9w-h99v","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GO-2026-6497","advisory_id":"4e19a323-87f2-461d-8a0f-29ff241546f0","event_types":["advisory"],"published_at":"2026-10-25T19:51:33.888886+00:00","technologies":["core-osv","oras-land-oras-go-v2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T20:23:47+00:00","detail_url":"/events/63825"},{"id":63907,"cve_ids":["CVE-2026-85732"],"payload":{"kind":"advisory","title":"oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing","summary":"## Summary oras-go's pagination helper `parseLink()` in `registry/remote/utils.go` follows the `Link` response header from a registry without validating the URL's host or scheme. When a malicious registry returns a `Link` header containing an absolute URL pointing to an arbitrary host (e.g., a cloud metadata endpoint), the client makes GET requests to that host from the victim's network. This affects all pagination-based listing operations: Tags, Referrers, and Repositories (catalog). ## Root Cause `parseLink()` at `registry/remote/utils.go:54` calls `resp.Request.URL.Parse(link)` which, for absolute URLs, returns the absolute URL unchanged. The result is passed directly to the next pagination loop iteration where `http.NewRequestWithContext()` creates a GET request to the attacker-specified URL. No host comparison, scheme validation, or IP filtering exists between `parseLink` output and the HTTP request. ## Affected Code Paths - `registry/remote/repository.go:Tags()` calls `parseLink()` for next page URL - `registry/remote/repository.go:Referrers()` calls `parseLink()` for next page URL - `registry/remote/registry.go:Repositories()` calls `parseLink()` for next page URL ## Impact **Blind SSRF from the victim's network.** A malicious registry operator can force any oras-go client that lists tags, referrers, or repositories to issue GET requests to arbitrary internal endpoints: - Cloud instance metadata endpoints for service discovery and IAM role enumeration - Internal HTTP s","evidence":"osv:GHSA-h7vf-4x9w-h99v","products":[{"name":{"value":"oras.land/oras-go/v2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"GHSA-h7vf-4x9w-h99v","aliases":["CVE-2026-85732","GHSA-h7vf-4x9w-h99v","GO-2026-6497"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.2"}]}],"package":{"name":"oras.land/oras-go/v2","purl":"pkg:golang/oras.land/oras-go/v2","ecosystem":"Go"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-h7vf-4x9w-h99v/GHSA-h7vf-4x9w-h99v.json","last_known_affected_version_range":"<= 2.6.1"}}],"modified":"2026-10-01T20:55:52.275640599Z","provider":"osv","references":["https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v","https://nvd.nist.gov/vuln/detail/CVE-2026-85732","https://github.com/oras-project/oras-go/commit/31da1963f8c327dd089cd29faeae95cf0fc50842","https://github.com/oras-project/oras-go","https://github.com/oras-project/oras-go/releases/tag/v2.6.2"],"provider_metadata":{"cwe_ids":["CWE-918"],"severity":"MODERATE","github_reviewed":true,"nvd_published_at":"2026-09-16T17:18:16Z","github_reviewed_at":"2026-09-17T17:16:02Z"}},"related_cves":[{"value":"CVE-2026-85732","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":null},"group_id":"osv:GHSA-h7vf-4x9w-h99v","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-h7vf-4x9w-h99v","advisory_id":"ee493bad-3d49-4f96-b94a-98f626d41b8b","event_types":["advisory"],"published_at":"2026-10-25T19:52:24.157085+00:00","technologies":["core-osv","oras-land-oras-go-v2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-17T17:16:02+00:00","detail_url":"/events/63907"}]}}],"next_after":70957,"next_before":64554}