PT-2026-33882 · Openbao+1 · Openbao+1
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
OpenBao versions prior to 2.5.3
Description
The OCI plugin downloader contains an issue in the
ExtractPluginFromImage() function where plugin binaries are extracted from container images by streaming decompressed tar data via io.Copy without a limit on the number of bytes written. An attacker controlling or compromising the OCI registry can provide a crafted image containing a decompression bomb—a file that expands to an arbitrarily large size upon decompression—leading to disk exhaustion. Because the SHA256 integrity check is performed only after the file is fully written to disk, the hash mismatch is detected too late to prevent the impact. This allows an attacker to replace a legitimate plugin image without needing to alter its signature.Recommendations
Update to version 2.5.3.
Exploit
Fix
DoS
Uncontrolled Recursion
Allocation of Resources Without Limits
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Openbao
Red Os