Released August 21, 2026 · Repository: owncloud/ocis · Release page: github.com/owncloud/ocis/releases/tag/v8.0.8
ownCloud Infinite Scale (oCIS) 8.0.8 is a patch release on the 8.0.x line, and the headline is security: two dependency bumps close out real vulnerabilities. Alongside those, this release fixes a bug that could corrupt share metadata under concurrent writes, adds caching for LDAP instance mapper lookups, and adds TLS support for NATS-based store, cache, and registry connections.
Security
Two changes here are security fixes, both dependency bumps:
- golang.org/x/image bumped to v0.45.0. This addresses GO-2026-6222, described in the release notes as excessive memory allocation during VP8L decoding. VP8L is the lossless codec inside WebP, so the practical risk is a resource-exhaustion (denial-of-service) condition triggered by a crafted image that oCIS or one of its components decodes.
- Go bumped to 1.25.13. The release notes attribute this to “a stdlib CVE vulnerability detected by release image scanning” without naming the CVE.
SOURCE GAP: the specific CVE identifier for the Go standard-library fix is not given in the release body, and this post does not invent one.
Neither fix requires configuration changes; both ship as part of the normal binary and container image build.
Bugfixes
Two fixes affect runtime correctness rather than security:
- Share metadata corruption under concurrent operations. Concurrent share operations against the same resource could corrupt share metadata. The fix adds compare-and-swap (etag) validation before writes: oCIS now detects a concurrent write attempt via a mismatched etag and retries the operation instead of writing over stale state.
- LDAP instance mapper caching. The LDAP identity backend previously issued an uncached lookup for every instance mapper resolution, which became a bottleneck under load. 8.0.8 caches these lookups, including negative (not-found) results, for a configurable TTL. Deployments using the LDAP backend at scale should see fewer redundant directory queries; the exact TTL default and its configuration key are not stated in the release notes.
Enhancement
NATS-based store, cache, and service-registry connections (nats-js-kv) now support TLS, configurable through environment variables. Previously these internal connections were unencrypted regardless of deployment; this is now optional and administrator-controlled rather than a default behavior change.
Upgrade notes
The release notes do not list any breaking changes, migration steps, or configuration that must change to adopt 8.0.8 — this is a patch release within the 8.0.x series. Administrators running LDAP at scale or NATS-based deployments are the two groups most likely to notice a behavioral difference (fewer LDAP round-trips; optional TLS on internal NATS connections). Everyone running 8.0.x should still treat the two security bumps as the primary reason to upgrade, since both apply unconditionally to the affected code paths regardless of configuration.
Source: GitHub Release description — read in full at github.com/owncloud/ocis/releases/tag/v8.0.8.
