OpenBao’s OCI plugin downloader performs an unbounded io.Copy when extracting a plugin binary from a container image. An attacker who can supply a malicious image to the OCI registry can embed a decompression bomb that expands into an arbitrarily large file. Because the SHA256 integrity check is only performed after the file has been fully written, the hash mismatch is detected only after disk space has been exhausted. The result is a denial‑of‑service condition and the attacker can replace a legitimate plugin image without altering its signature.

This flaw affects all deployments of the openbao product that use the OCI plugin downloader, specifically any instance running OpenBao before version 2.5.3. The affected vendor and product are OpenBao, an open‑source identity‑based secrets management system.

The CVSS score is 3.1, indicating a low severity. The EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the ability to control or compromise the OCI registry referenced by the victim; once a crafted image is served, the unbounded copy will drain disk space. The impact is limited to the service process that performs the extraction, but repeated or automated attacks could cripple the host and allow the attacker to replace the plugin binary after the integrity check fails.