Skip to content
OpenAdvisories

Package · Go

github.com/docker/distribution

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 6.8
    CVE-2026-85747

    Distribution: Client `manifests.Get()` does not verify returned content against requested digest

    Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body ag…

    distribution distribution docker-registry docker-registry Debian Ubuntu Go
  • Medium 6.5
    CVE-2023-2253

    distribution catalog API endpoint can lead to OOM via malicious user input

    A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (query string: `n`). This vulnerability allows a malicious user to submit an unreasonably large value for…

    docker-registry docker-registry github.com/distribution/distribution github.com/docker/distribution Debian Ubuntu Go
  • Low 3.0
    GHSA-qq97-vm5h-rrhg

    OCI Manifest Type Confusion Issue

    ### Impact Systems that rely on digest equivalence for image attestations may be vulnerable to type confusion. ### Patches Upgrade to at least `v2.8.0-beta.1` if you are running `v2.x` release. If you use the code from the `main` branch, update at least to th…

    github.com/docker/distribution Go
  • High 7.5
    CVE-2017-11468

    Docker Registry has Allocation of Resources Without Limits or Throttling

    Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.

    docker-registry docker-registry github.com/docker/distribution Debian Ubuntu Go