{"action":"Upgrade oras.land/oras-go/v2 to 2.6.2 or later.","affected":[{"fixed":"2.6.2","introduced":"0"}],"component":"oras.land/oras-go/v2","cve_ids":["CVE-2026-85732"],"ecosystem":"Go","epss":0.00384,"exploited":false,"fixed_versions":["2.6.2"],"ghsa_id":"GHSA-h7vf-4x9w-h99v","id":"tcs_01M5KFC4PP5MG3FYPTQKY5B3VC","modified_at":"2026-10-01T20:55:52.275640599Z","published_at":"2026-09-17T17:16:02Z","references":["https://osv.dev/vulnerability/GHSA-h7vf-4x9w-h99v","https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v","https://nvd.nist.gov/vuln/detail/CVE-2026-85732","https://github.com/oras-project/oras-go/commit/31da1963f8c327dd089cd29faeae95cf0fc50842","https://github.com/oras-project/oras-go","https://github.com/oras-project/oras-go/releases/tag/v2.6.2"],"severity":{"label":"medium","score":4.7},"sources":[{"source":"osv","source_id":"GHSA-h7vf-4x9w-h99v","url":"https://osv.dev/vulnerability/GHSA-h7vf-4x9w-h99v"}],"summary":"oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing"}