CVE-2023-2253

2023-06-0600:00:00

CWE-475

redhat

www.cve.org

flaw

_catalog

denial of service

endpoint

distribution

cve-2023-2253

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.2%

JSON

A flaw was found in the /v2/_catalog endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (query string: n). This vulnerability allows a malicious user to submit an unreasonably large value for n, causing the allocation of a massive string array, possibly causing a denial of service through excessive use of memory.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "distribution/distribution",
    "versions": [
      {
        "version": "NA",
        "status": "affected"
      }
    ]
  }
]