https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 01:54:10 +0000 https://vulnerability.circl.lu/vuln/ghsa-hqxw-f8mx-cpmw <p><strong>Affected:</strong> Go: github.com/docker/distribution</p> <p>### Impact</p> <p>Systems that run `distribution` built after a specific commit running on memory-restricted environments can suffer from denial of service by a crafted malicious `/v2/_catalog` API endpoint request.</p> <p>### Patches</p> <p>Upgrade to at least 2.8.2-beta.1 if you are running `v2.8.x` release. If you use the code from the main branch, update at least to the commit after [f55a6552b006a381d9167e328808565dd2bf77dc](https://github.com/distribution/distribution/commit/f55a6552b006a381d9167e328808565dd2bf77dc).</p> <p>### Workarounds</p> <p>There is no way to work around this issue without patching. Restrict access to the affected API endpoint: see the recommendations section.</p> <p>### References</p> <p>`/v2/_catalog` endpoint accepts a parameter to control the maximum amount of records returned (query string: `n`).</p> <p>When not given the default `n=100` is used. The server trusts that `n` has an acceptable value, however when using a maliciously large value, it allocates an array/slice of `n` of strings before filling the slice with data.</p> <p>This behaviour was introduced ~7yrs ago [1].</p> <p>### Recommendation</p> <p>The `/v2/_catalog` endpoint was designed specifically to do registry syncs with search or other API systems. Such an endpoint would create a lot of load on the backend system, due to overfetch required to serve a request in certain implementations.</p> <p>Because of this, we strongly recommend keeping this API endpoint behind heightened privilege and avoiding leaving it exposed to the internet.</p> <p>### For mor…</p> <p><strong>Affected:</strong> Go: github.com/docker/distribution</p> <p>### Impact</p> <p>Systems that run `distribution` built after a specific commit running on memory-restricted environments can suffer from denial of service by a crafted malicious `/v2/_catalog` API endpoint request.</p> <p>### Patches</p> <p>Upgrade to at least 2.8.2-beta.1 if you are running `v2.8.x` release. If you use the code from the main branch, update at least to the commit after [f55a6552b006a381d9167e328808565dd2bf77dc](https://github.com/distribution/distribution/commit/f55a6552b006a381d9167e328808565dd2bf77dc).</p> <p>### Workarounds</p> <p>There is no way to work around this issue without patching. Restrict access to the affected API endpoint: see the recommendations section.</p> <p>### References</p> <p>`/v2/_catalog` endpoint accepts a parameter to control the maximum amount of records returned (query string: `n`).</p> <p>When not given the default `n=100` is used. The server trusts that `n` has an acceptable value, however when using a maliciously large value, it allocates an array/slice of `n` of strings before filling the slice with data.</p> <p>This behaviour was introduced ~7yrs ago [1].</p> <p>### Recommendation</p> <p>The `/v2/_catalog` endpoint was designed specifically to do registry syncs with search or other API systems. Such an endpoint would create a lot of load on the backend system, due to overfetch required to serve a request in certain implementations.</p> <p>Because of this, we strongly recommend keeping this API endpoint behind heightened privilege and avoiding leaving it exposed to the internet.</p> <p>### For mor…</p> https://vulnerability.circl.lu/vuln/ghsa-hqxw-f8mx-cpmw