CVE-2026-39396
medium
CVSS v3
6.5
CVSS v2
—
VIR risk
6.5
Description
OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)
Predictions
Exploit likelihood
75%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: security-advisories@github.com — https://github.com/openbao/openbao/security/advisories/GHSA-r65v-xgwc-g56j
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Go | github.com/openbao/openbao | <0.0.0-20260420180337-2b2a901aa9f7 | 0.0.0-20260420180337-2b2a901aa9f7 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| openbao | openbao | {"endExcluding":"2.5.3"} | 2.5.3 |
References
- https://github.com/openbao/openbao/security/advisories/GHSA-r65v-xgwc-g56j
- https://nvd.nist.gov/vuln/detail/CVE-2026-39396
- https://github.com/openbao/openbao/pull/2941
- https://github.com/openbao/openbao/commit/af576af5322c6552a017ad10fd76aa4f40fd021e
- https://github.com/openbao/openbao
- https://github.com/openbao/openbao/releases/tag/v2.5.3
CWEs
CWE-400 CWE-674 CWE-770
Verify integrity in audit chain (admin only). AS-IS.