VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/deislabs/oras: vulnerability history, versions and safety

github.com/deislabs/oras is a package in the Go ecosystem. Vulert records 3 vulnerabilities for it across 120 releases, from Apr 2021 to Feb 2022. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
3 vulnerabilities recorded H1 U2
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
0 in the last 12 months

Nothing new recorded in the last year.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/deislabs/oras vulnerabilities

Vulert verdict on github.com/deislabs/oras v0.11.1 i

Updated on 22 Oct 2026

Action needed: v0.11.1 has 3 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 74/100
  • Security Minor issues
  • Maintenance Slowing
  • Popularity Key ecosystem project
  • Community Moderate

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v0.11.1 — affected i
  • Vulnerabilities on record 3 over 1 year · 0 in the last year i
  • Latest disclosure 15 Feb 2022 i
  • Highest CVSS 7.7 i
  • With no published fix 0 i
  • Stars 2,473 i
  • OpenSSF scorecard 7/10 i
  • Last release 67 months ago i
  • Licence MIT i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/deislabs/oras, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.11.2-0.20211111051810-58fa344544b3 11 Nov 2021 H1 U2 MIT Yes Details →
v0.2.1-alpha.1 11 Nov 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20211103064046-ce63e048fef1 03 Nov 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20211029032903-7e9d3a890899 29 Oct 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20211029032729-6d6ddbd2d79d 29 Oct 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210920194008-09cb56531b49 20 Sep 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210914223406-f01d9756e925 14 Sep 2021 H1 U2 MIT Yes Details →
v0.2.0-alpha.1 14 Sep 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210913212735-e427ad83c0e6 13 Sep 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210913212319-abd63664c135 13 Sep 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210913165907-d3246cad3bab 13 Sep 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210907112649-246bc2e1779d 07 Sep 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210906074438-a50a6d78c4d9 06 Sep 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210906072618-888591e46a0c 06 Sep 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210825172201-01bc2b4790e5 25 Aug 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210628085823-f15672b7fdbc 28 Jun 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210601174807-2df178d734cd 01 Jun 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210601172214-7be4945f9a50 01 Jun 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210519200648-33a30cd1356f 19 May 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210519134842-a7daebd6dfb9 19 May 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210518030109-d400de233c7b 18 May 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210518025718-c46d3e3fd765 18 May 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210518010806-7ecdb441df81 18 May 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210518010619-e85f6b79adc7 18 May 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210506135129-c9d1b33ce6d0 06 May 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210505151118-a7e985df7d8d 05 May 2021 H1 U2 MIT Yes Details →
v0.11.1-0.20210427130330-1ec0c36eb2c1 27 Apr 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210427130330-1ec0c36eb2c1 27 Apr 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210426190757-b76d6d902cb1 26 Apr 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210426153506-235ef92fa5f3 26 Apr 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210414031640-8627d45e2867 14 Apr 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210414024200-e522a279f571 14 Apr 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210409055644-86908078d8ae 09 Apr 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210408084747-fd3aaf3b5b04 08 Apr 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210407011400-c1133fedbe25 07 Apr 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210404191820-804f046bf1b5 04 Apr 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210404191239-1cc4b24c0996 04 Apr 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210404190956-61426db0a40e 04 Apr 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210404013352-6977a420ff80 04 Apr 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210401075439-60b9dab763ac 01 Apr 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210401074759-db537ea3f636 01 Apr 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210331130114-f0920ba272e8 31 Mar 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210331123410-0e3fc1859f87 31 Mar 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210331094743-321d79ca23ef 31 Mar 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210331083434-1d4a86e26aa7 31 Mar 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210329103940-76586ec8fb0c 29 Mar 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210329095106-7aeec782063d 29 Mar 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210329063148-bfde944f9c65 29 Mar 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210329062908-0e3c1f4cd052 29 Mar 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210329051144-8d49927d0f22 29 Mar 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210326111233-55d1abe3e841 26 Mar 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210326074249-350dae6874a1 26 Mar 2021 H1 U2 MIT Yes Details →
v0.11.2-0.20210326063815-f56d806fb18c 26 Mar 2021 H1 U2 MIT Yes Details →
v0.11.1 18 Mar 2021 H1 U2 MIT Yes Details →
v0.11.1-0.20210318174412-27982906a968 18 Mar 2021 H1 U2 MIT Yes Details →
v0.11.1-0.20210318063915-23f76e801197 18 Mar 2021 H1 U2 MIT Yes Details →
v0.11.0 16 Mar 2021 H1 U2 MIT Yes Details →
v0.10.1-0.20210316193723-f13f5cb71232 16 Mar 2021 H1 U2 MIT Yes Details →
v0.10.1-0.20210316191519-ed267c1371f6 16 Mar 2021 H1 U2 MIT Yes Details →
v0.10.1-0.20210316083734-193f99a91e5e 16 Mar 2021 H1 U2 MIT Yes Details →
v0.10.1-0.20210312002636-75801fef923e 12 Mar 2021 H1 U2 MIT Yes Details →
v0.10.1-0.20210311193139-0380ecb6f743 11 Mar 2021 H1 U2 MIT Yes Details →
v0.10.1-0.20210310212402-a2848fe3ceb9 10 Mar 2021 H1 U2 MIT Yes Details →
v0.10.1-0.20210310210704-1322fd60c995 10 Mar 2021 H1 U2 MIT Yes Details →
v0.10.1-0.20210310205421-061fc969f1b9 10 Mar 2021 H1 U2 MIT Yes Details →
v0.10.1-0.20210302005037-faf2f4b1daa2 02 Mar 2021 H1 U2 MIT Yes Details →
v0.10.1-0.20210226144529-d71f5ec32980 26 Feb 2021 H1 U2 MIT Yes Details →
v0.10.1-0.20210225045324-30575f02d3c4 25 Feb 2021 H1 U2 MIT Yes Details →
v0.10.1-0.20210217194124-ba88a87b0105 17 Feb 2021 H1 U2 MIT Yes Details →
v0.10.1-0.20210217192828-81b0778a3c9a 17 Feb 2021 H1 U2 MIT Yes Details →
v0.10.1-0.20210217192731-efed9d8da98a 17 Feb 2021 H1 U2 MIT Yes Details →
v0.10.1-0.20210217144034-b6ff22e4c540 17 Feb 2021 H1 U2 MIT Yes Details →
v0.10.1-0.20210217143853-1c692bb82f62 17 Feb 2021 H1 U2 MIT Yes Details →
v0.10.1-0.20210217143633-c7e5447ec710 17 Feb 2021 H1 U2 MIT Yes Details →
v0.10.1-0.20210217143336-e80eee0860e7 17 Feb 2021 H1 U2 MIT Yes Details →
v0.10.1-0.20210209153441-38788d6b6fe4 09 Feb 2021 H1 U2 MIT Yes Details →
v0.10.0 04 Feb 2021 H1 U2 MIT Yes Details →
v0.9.1-0.20210204165507-84cf58779173 04 Feb 2021 H1 U2 MIT Yes Details →
v0.9.1-0.20210204165301-b95c3226d26a 04 Feb 2021 H1 U2 MIT Yes Details →
v0.9.1-0.20210204164943-b4a877c3a3d4 04 Feb 2021 H1 U2 MIT Yes Details →
v0.9.0 22 Jan 2021 H1 U2 MIT Yes Details →
v0.8.2-0.20210122151957-200d032e6ec0 22 Jan 2021 H1 U2 MIT Yes Details →
v0.8.2-0.20210122151017-ccd6d0074e65 22 Jan 2021 H1 U2 MIT Yes Details →
v0.8.2-0.20210122145513-4891e6936363 22 Jan 2021 H1 U2 MIT Yes Details →
v0.8.2-0.20210122021055-a71cd72c8c74 22 Jan 2021 H1 U2 MIT Yes Details →
v0.8.2-0.20210122013724-ee4d00f07953 22 Jan 2021 H1 U2 MIT Yes Details →
v0.8.2-0.20210121221419-07b7182640ab 21 Jan 2021 H1 U2 MIT Yes Details →
v0.8.2-0.20201214145259-d3683ca92611 14 Dec 2020 H1 U2 MIT Yes Details →
v0.8.2-0.20201212064514-9a978bb22a63 12 Dec 2020 H1 U2 MIT Yes Details →
v0.8.2-0.20201201145517-50141daa2bf1 01 Dec 2020 H1 U2 MIT Yes Details →
v0.8.2-0.20201117173803-9555bb810abd 17 Nov 2020 H1 U2 MIT Yes Details →
v0.8.2-0.20201117173431-0bffdbc8b717 17 Nov 2020 H1 U2 MIT Yes Details →
v0.8.2-0.20201112033706-f7447b4c82c2 12 Nov 2020 H1 U2 MIT Yes Details →
v0.8.2-0.20201112032245-a64b0ac4faf2 12 Nov 2020 H1 U2 MIT Yes Details →
v0.8.2-0.20201112031228-b48943498979 12 Nov 2020 H1 U2 MIT Yes Details →
v0.8.2-0.20201112030425-63f4762af996 12 Nov 2020 H1 U2 MIT Yes Details →
v0.8.2-0.20201112025552-da7584b24bdf 12 Nov 2020 H1 U2 MIT Yes Details →
v0.8.2-0.20201112025304-ff657695a9d0 12 Nov 2020 H1 U2 MIT Yes Details →
v0.8.2-0.20201110191325-f1caa175232f 10 Nov 2020 H1 U2 MIT Yes Details →
v0.8.2-0.20201110161300-d2037e92aeb4 10 Nov 2020 H1 U2 MIT Yes Details →
v0.8.2-0.20201109161318-2ca946426597 09 Nov 2020 H1 U2 — Yes Details →
v0.8.2-0.20201028191344-4cae1dba9cb4 28 Oct 2020 H1 U2 — Yes Details →
v0.8.2-0.20201027131631-79a6cf6ab877 27 Oct 2020 H1 U2 — Yes Details →
v0.8.2-0.20201027131343-d1f055bd6b53 27 Oct 2020 H1 U2 — Yes Details →
v0.8.2-0.20201002163557-6414398e5145 02 Oct 2020 H1 U2 — Yes Details →
v0.8.2-0.20201001010246-78a9b6b637bb 01 Oct 2020 H1 U2 — Yes Details →
v0.8.2-0.20201001005643-ad8a2d65800f 01 Oct 2020 H1 U2 — Yes Details →
v0.8.2-0.20200928025624-73b72c5ddfc4 28 Sep 2020 H1 U2 — Yes Details →
v0.8.2-0.20200910173452-eeb3b5f12bc4 10 Sep 2020 H1 U2 — Yes Details →
v0.8.2-0.20200910134004-d19ad98995af 10 Sep 2020 H1 U2 — Yes Details →
v0.8.2-0.20200630024030-e68c514afd46 30 Jun 2020 H1 U2 — Yes Details →
v0.8.2-0.20200615143928-3a7c320f5b21 15 Jun 2020 H1 U2 — Yes Details →
v0.8.2-0.20200612183920-c4facb5b7752 12 Jun 2020 H1 U2 — Yes Details →
v0.8.2-0.20200611013345-2f7ca83c0052 11 Jun 2020 H1 U2 — Yes Details →
v0.8.2-0.20200605232609-16f59e3ef410 05 Jun 2020 H1 U2 — Yes Details →
v0.8.2-0.20200505182730-e227ad1d2ad6 05 May 2020 H1 U2 — Yes Details →
v0.8.2-0.20200306063504-19a0d4482aed 06 Mar 2020 H1 U2 — Yes Details →
v0.8.2-0.20200303234538-fb588f70f9c2 03 Mar 2020 H1 U2 — Yes Details →
v0.8.1 03 Feb 2020 H1 U2 — Yes Details →
v0.8.1-0.20200203195554-169a5428f68f 03 Feb 2020 H1 U2 — Yes Details →

The newest 120 of 233 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 2
  • 2022 1

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 0 of the 3 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/deislabs/oras

The 3 most severe of 3 vulnerabilities recorded for this package

Search all 3 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2021-21272: Zip Slip Directory Exploit in github.com/deislabs/oras 7.7 high 0.9.0 15 Feb 2022
CVE-2021-21272: Zip Slip Directory Exploit in github.com/deislabs/oras N/A unrated 0.9.0 14 Apr 2021
CVE-2021-21272: Zip slip directory exploit in github.com/deislabs/oras N/A unrated 0.9.0 14 Apr 2021

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 22/Oct/2026 · Vulnerabilities in our DB: 524173

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/deislabs/oras

Is github.com/deislabs/oras safe to use?

Vulert records 3 vulnerabilities for github.com/deislabs/oras in Go: 0 critical, 1 high, 0 medium and 0 low, plus 2 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/deislabs/oras's Vulert package health score?

Vulert scores github.com/deislabs/oras 74/100, which reads as in good shape. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/deislabs/oras affected?

Yes. v0.11.1, the version you would install today, has 3 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

Which version of github.com/deislabs/oras should I use?

v0.11.1 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/deislabs/oras have?

3 vulnerabilities are recorded for github.com/deislabs/oras in the Go ecosystem: 0 critical, 1 high, 0 medium and 0 low, plus 2 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/deislabs/oras vulnerabilities disclosed?

0 vulnerabilities were recorded for github.com/deislabs/oras in the last 12 months, and the oldest entry in this database dates to 14 Apr 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/deislabs/oras are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/deislabs/oras for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/deislabs/oras version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.