{"action":"Upgrade oras.land/oras-go/v2 to 2.6.2 or later.","affected":[{"fixed":"2.6.2","introduced":"0"}],"component":"oras.land/oras-go/v2","cve_ids":["CVE-2026-85732"],"ecosystem":"Go","epss":0.00384,"exploited":false,"fixed_versions":["2.6.2"],"ghsa_id":"GHSA-h7vf-4x9w-h99v","id":"tcs_01M5KGV2CZPQDADXDSAM44X1TX","modified_at":"2026-10-01T20:45:12.219872881Z","published_at":"2026-10-01T20:23:47Z","references":["https://osv.dev/vulnerability/GO-2026-6497","https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v","https://github.com/oras-project/oras-go/commit/31da1963f8c327dd089cd29faeae95cf0fc50842","https://github.com/oras-project/oras-go/releases/tag/v2.6.2"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-6497","url":"https://osv.dev/vulnerability/GO-2026-6497"}],"summary":"Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go"}