{"id":"GO-2026-5882","revision":"1085542026fd4e2a83b97138d63d2ea8","records":[{"revision":"1085542026fd4e2a83b97138d63d2ea8","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5882","aliases":["CVE-2026-50151","GHSA-jxpm-75mh-9fp7"],"title":"Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go","description":"Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go","state":0,"publishedAt":"2026-07-24T18:35:55+00:00","modifiedAt":"2026-07-24T19:00:26.7239422+00:00","affected":[{"ecosystem":"Go","name":"oras.land/oras-go/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.6.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7","https://github.com/oras-project/oras-go/commit/4683c46ef078091544f5f55fd25102f002806991","https://github.com/oras-project/oras-go/pull/1152","https://github.com/oras-project/oras-go/releases/tag/v2.6.1"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5882","license":"OSV · upstream source license applies","key":"osv:GO-2026-5882","identifiers":["GO-2026-5882","CVE-2026-50151","GHSA-jxpm-75mh-9fp7"]},"retained":false,"historicalAffected":[]}],"coverage":[]}