{"id":"GHSA-r65v-xgwc-g56j","revision":null,"records":[{"revision":"9fb2cbca897c438cb0bf683e69205988","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-39396","aliases":[],"title":"OpenBao has Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)","description":"OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, `ExtractPluginFromImage()` in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via `io.Copy` with no upper bound on the number of bytes written. An attacker who controls or compromises the OCI registry referenced in the victim's configuration can serve a crafted image containing a decompression bomb that decompresses to an arbitrarily large file. The SHA256 integrity check occurs after the full file is written to disk, meaning the hash mismatch is detected only after the damage (disk exhaustion) has already occurred. This allow the attacker to replace **legit plugin image** with no need to change its signature. Version 2.5.3 contains a patch.","state":0,"publishedAt":"2026-04-21T00:44:53.943+00:00","modifiedAt":"2026-04-21T19:49:18.821+00:00","affected":[{"ecosystem":"Vendor product","name":"openbao","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"openbao\",\n                    \"product\": \"openbao\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.5.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","score":3.1,"severity":"LOW"}],"references":["https://github.com/openbao/openbao/security/advisories/GHSA-r65v-xgwc-g56j"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-39396","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-39396","identifiers":["CVE-2026-39396"]},"retained":false,"historicalAffected":[]},{"revision":"94c12512b6e343acafe766aa75506a77","observedAt":"2026-11-13T20:11:09.697+00:00","statement":{"source":"euvd","id":"EUVD-2026-24031","aliases":["CVE-2026-39396","GHSA-r65v-xgwc-g56j"],"title":"OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, `ExtractPluginFromImage()` in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via…","description":"OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, `ExtractPluginFromImage()` in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via `io.Copy` with no upper bound on the number of bytes written. An attacker who controls or compromises the OCI registry referenced in the victim's configuration can serve a crafted image containing a decompression bomb that decompresses to an arbitrarily large file. The SHA256 integrity check occurs after the full file is written to disk, meaning the hash mismatch is detected only after the damage (disk exhaustion) has already occurred. This allow the attacker to replace **legit plugin image** with no need to change its signature. Version 2.5.3 contains a patch.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","score":3.1,"severity":null}],"references":["https://github.com/openbao/openbao/security/advisories/GHSA-r65v-xgwc-g56j"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24031","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 21, 2026, 12:44:53 AM","dateUpdated":"Apr 21, 2026, 7:49:18 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2026:10594-1","title":"openbao-2.5.3-1.1 on GA media","vulnerabilityIds":["CVE-2026-3605","CVE-2026-39388","CVE-2026-39396","CVE-2026-39946","CVE-2026-40264","CVE-2026-5807"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-24031","identifiers":["EUVD-2026-24031","CVE-2026-39396","GHSA-r65v-xgwc-g56j"]},"retained":false,"historicalAffected":[]},{"revision":"216d7578183744458df7f4b1d5c96ba7","observedAt":"2026-11-12T15:18:43.883+00:00","statement":{"source":"nvd","id":"CVE-2026-39396","aliases":[],"title":"OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, `ExtractPluginFromImage()` in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via…","description":"OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, `ExtractPluginFromImage()` in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via `io.Copy` with no upper bound on the number of bytes written. An attacker who controls or compromises the OCI registry referenced in the victim's configuration can serve a crafted image containing a decompression bomb that decompresses to an arbitrarily large file. The SHA256 integrity check occurs after the full file is written to disk, meaning the hash mismatch is detected only after the damage (disk exhaustion) has already occurred. This allow the attacker to replace **legit plugin image** with no need to change its signature. Version 2.5.3 contains a patch.","state":0,"publishedAt":"2026-04-21T01:16:06.507+00:00","modifiedAt":"2026-11-11T23:10:00.263+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","score":3.1,"severity":"LOW"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/openbao/openbao/security/advisories/GHSA-r65v-xgwc-g56j"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-39396","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-400","CWE-674","CWE-770"],"productCriteria":["cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-04-21T01:16:06.507","lastModified":"2026-11-11T23:10:00.263"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-39396","identifiers":["CVE-2026-39396"]},"retained":false,"historicalAffected":[]},{"revision":"a010d6101fa54fe9b1adeb4bc7c6d8b1","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-r65v-xgwc-g56j","aliases":["BIT-openbao-2026-39396","CVE-2026-39396","GO-2026-5609"],"title":"OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)","description":"### Summary\n\n`ExtractPluginFromImage()` in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via `io.Copy` with no upper bound on the number of bytes written.\nAn attacker who controls or compromises the OCI registry referenced in the victim's configuration can serve a crafted image containing a decompression bomb that decompresses to an arbitrarily large file.\n\nThe SHA256 integrity check occurs after the full file is written to disk, meaning the hash mismatch is detected only after the damage (disk exhaustion) has already occurred. This allow the attacker to replace **legit plugin image** with no need to change its signature.\n\n### Details\n\n#### Root cause\n\n`helper/pluginutil/oci/downloader.go:301`:\n\n```go\nif _, copyErr := io.Copy(outFile, tarReader); copyErr != nil {\n```\n\n`io.Copy()` reads until EOF with no size limit.  \nThe tar `header.Size` field is never validated before the copy, and `mutate.Extract` decompresses all gzip layers in memory/streaming, resulting in unbounded decompression-to-disk.\n\n### PoC\n\n1. Set up a malicious OCI registry\n2. Create a decompression bomb binary:\n   ```bash\n   dd if=/dev/zero bs=1G count=100 > /tmp/bomb-binary\n   ```\n3. Package it in a minimal OCI image\n4. Push to the malicious registry\n5. Configure victim OpenBao to use this registry:\n   ```hcl\n   plugin \"secrets\" \"bomb\" {\n     image       = \"evil.example.com/plugin\"\n     version     = \"v1.0.0\"\n     binary_name = \"openbao-plugin-secrets-bomb\"\n     sha256sum   = \"0000000000000000000000000000000000000000000000000000000000000000\"\n   }\n   plugin_auto_download = true\n   ```\n6. Start OpenBao (or trigger SIGHUP), load OCI image, disk fill -> cause DoS\n\n### Impact\n\n- Denial of Service: Disk exhaustion on the OpenBao server\n- Cascading failure: Co-located services (databases, other apps) also fail when the disk is full\n- Difficult recovery: If the process is killed mid-extraction, the partial file remains on disk and is not cleaned up\n- Repeated exploitation: On SIGHUP or restart with plugin_auto_download = true, the bomb is re-downloaded\n\n### Remediation\n\n1. Validate `header.Size` against a configurable maximum before opening the output file\n2. Wrap `tarReader` in `io.LimitReader(tarReader, maxSize+1)` and check bytes written after copy\n3. Add a max_size configuration field to PluginConfig for operator control (default: 1 GiB)","state":0,"publishedAt":"2026-04-21T18:24:10+00:00","modifiedAt":"2026-09-10T03:51:02.9112639+00:00","affected":[{"ecosystem":"Go","name":"github.com/openbao/openbao","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260420180337-2b2a901aa9f7"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/openbao/openbao/security/advisories/GHSA-r65v-xgwc-g56j","https://nvd.nist.gov/vuln/detail/CVE-2026-39396","https://github.com/openbao/openbao/pull/2941","https://github.com/openbao/openbao/commit/af576af5322c6552a017ad10fd76aa4f40fd021e","https://github.com/openbao/openbao","https://github.com/openbao/openbao/releases/tag/v2.5.3"],"sourceUrl":"https://github.com/advisories/GHSA-r65v-xgwc-g56j","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-r65v-xgwc-g56j","identifiers":["GHSA-r65v-xgwc-g56j","BIT-openbao-2026-39396","CVE-2026-39396","GO-2026-5609"]},"retained":false,"historicalAffected":[]},{"revision":"96f32b40ce9a406dac011c33bc8c1a01","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5609","aliases":["BIT-openbao-2026-39396","CVE-2026-39396","GHSA-r65v-xgwc-g56j"],"title":"OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS) in github.com/openbao/openbao","description":"OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS) in github.com/openbao/openbao","state":0,"publishedAt":"2026-06-25T22:34:34+00:00","modifiedAt":"2026-07-27T09:11:19.2631065+00:00","affected":[{"ecosystem":"Go","name":"github.com/openbao/openbao","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260420180337-2b2a901aa9f7"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/openbao/openbao/security/advisories/GHSA-r65v-xgwc-g56j","https://nvd.nist.gov/vuln/detail/CVE-2026-39396","https://github.com/openbao/openbao/commit/af576af5322c6552a017ad10fd76aa4f40fd021e","https://github.com/openbao/openbao/pull/2941","https://github.com/openbao/openbao/releases/tag/v2.5.3"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5609","license":"OSV · upstream source license applies","key":"osv:GO-2026-5609","identifiers":["GO-2026-5609","BIT-openbao-2026-39396","CVE-2026-39396","GHSA-r65v-xgwc-g56j"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T12:00:55.3946839+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T12:00:55.3946839+00:00","lastSuccessAt":"2026-11-15T12:00:55.579435+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:55.5794357+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-9f2801eea6d0b63da2583193add6be220e1b53bbbe4ef94b9346425ef1596ca8","complete":true,"records":425788,"lastAttemptAt":"2026-11-15T12:00:54.4294537+00:00","lastSuccessAt":"2026-11-15T12:00:54.4082037+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:54.4294537+00:00","snapshotPublishedAt":"2026-11-15T11:26:58+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-850c26e23e9a454eb8654cf34d45fa51","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T12:10:42.9128167+00:00","lastSuccessAt":"2026-11-15T12:10:42.908+00:00","error":"92 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T12:10:42.908+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13568,"expectedIdentifiers":13874,"failedIdentifiers":92},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T12:00:55.3946839+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T12:00:55.3946839+00:00","lastSuccessAt":"2026-11-15T12:00:55.580236+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:55.580236+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-d33b5144615b488f88b7a7390696bc39","complete":false,"records":13833,"lastAttemptAt":"2026-11-15T12:01:03.1788889+00:00","lastSuccessAt":"2026-11-15T10:02:36.038+00:00","error":"1 identifier lookups failed; latest failures include HttpError (HTTP 503). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T10:02:36.038+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13873,"expectedIdentifiers":13874,"failedIdentifiers":1},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T12:00:55.0947737+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:55.0947737+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T12:00:54.588948+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:54.588948+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-6086d649bcb454cdf302d7d9275177bda73550e1b6e446b3520e9b6266d3582c","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T12:00:55.3229475+00:00","lastSuccessAt":"2026-11-15T11:05:17.1034234+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:55.3229475+00:00","snapshotPublishedAt":"2026-11-15T10:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ff18f36f13fcca3a20a3fb9274b59b8872d18869a99071730e1e79b625c8f612","complete":true,"records":232475,"lastAttemptAt":"2026-11-15T12:00:54.6916951+00:00","lastSuccessAt":"2026-11-15T11:05:10.4195883+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:54.6916951+00:00","snapshotPublishedAt":"2026-11-15T10:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}