CVEvulnerability

CVE-2026-85747

6.8 MEDIUM Published 2026-10-13 Modified 2026-10-18 Official page ↗
Status
Awaiting Analysis
Published
2026-10-13
Last modified
2026-10-18
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Weaknesses
CWE-354

Description

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a malicious or intercepted registry response to substitute attacker-chosen manifest content even when Docker-Content-Digest claims the requested value. The bundled pull-through proxy in registry/proxy/proxymanifeststore.go can cache and re-serve the substituted manifest. This issue is fixed in version 3.1.2.

Related

Weakness · CWE (1)

  • CWE-354 Improper Validation of Integrity Check Value weakness

References