Skip to content
OpenAdvisories

Package · Go

github.com/distribution/distribution/v3

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.8
    CVE-2026-85747

    Distribution: Client `manifests.Get()` does not verify returned content against requested digest

    Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body ag…

    distribution distribution docker-registry docker-registry Debian Ubuntu Go
  • Medium 6.3
    CVE-2026-41888

    Distribution: Tag deletion bypasses `storage.delete.enabled` configuration

    Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags fro…

    distribution distribution github.com/distribution/distribution docker-registry Debian Ubuntu Go