Skip to content
OpenAdvisories

Vendor

distribution

5 known vulnerabilities.

Products

distribution 5
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.8
    CVE-2026-85747

    Distribution: Client `manifests.Get()` does not verify returned content against requested digest

    Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body ag…

    distribution distribution docker-registry docker-registry Debian Ubuntu Go
  • Medium 6.3
    CVE-2026-41888

    Distribution: Tag deletion bypasses `storage.delete.enabled` configuration

    Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags fro…

    distribution distribution github.com/distribution/distribution docker-registry Debian Ubuntu Go
  • Medium 6.6
    CVE-2025-24976

    Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT

    Distribution is a toolkit to pack, ship, store, and deliver container content. Systems running registry versions 3.0.0-beta.1 through 3.0.0-rc.2 with token authentication enabled may be vulnerable to an issue in which token authentication allows an attacker t…

    distribution distribution github.com/distribution/distribution Go