Skip to content
Security
فارسی
Sign in / Register
Vulnerabilities
Products
Plugins
All products
github.com/distribution/distribution/v3
Go
· Package
5 reports
Vulnerability alerts
Follow
Package, identifier or title
Search
Severity
All
Critical
High
Medium
Low
Unknown
Fix status
All
Fix reported
No fix reported
Sort by
Recently updated
Highest severity
Report
Product
Ecosystem
Severity
Fix status
Last updated
Distribution: Client `manifests.Get()` does not verify returned content against requested digest
CVE-2026-85747 · GHSA-685W-Q87J-WQW3
Version ranges need review.
github.com/distribution/distribution/v3
github.com/distribution/distribution
Go
Red Hat
Medium
Fix reported
2026-11-06
Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm
CVE-2026-33540 · GHSA-3P65-76G6-3W7R
Version ranges need review.
github.com/distribution/distribution/v3
github.com/distribution/distribution
Go
Red Hat
High
Fix reported
2026-09-10
Distribution: stale blob access resurrection via repo-scoped redis descriptor cache invalidation
CVE-2026-35172 · GHSA-F2G3-HH2R-CWGC
Version ranges need review.
github.com/distribution/distribution/v3
github.com/distribution/distribution
Go
Red Hat
High
Fix reported
2026-08-19
Distribution's tag deletion bypasses `storage.delete.enabled` configuration
CVE-2026-41888 · GHSA-6PJF-3R9X-M592
Version ranges need review.
github.com/distribution/distribution/v3
github.com/distribution/distribution
Go
Red Hat
Medium
Fix reported
2026-08-18
Distribution's token authentication allows to inject an untrusted signing key in a JWT
CVE-2025-24976 · GHSA-PHW4-MC57-4HWC
github.com/distribution/distribution/v3
github.com/distribution/distribution
Go
Red Hat
High
Fix reported
2026-02-04
