A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution which accepts a parameter to control the maximum number of records returned (query string: `n`). This vulnerability allows a malicious user to submit an unreasonably large value for `n` causing the allocation of a massive string array possibly causing a denial of service through excessive use of memory.

🗓️ 07 Jun 2023 07:00:00Reported by MicrosoftType

mscve🔗 msrc.microsoft.com👁 9 Views

Flaw in distribution /v2/_catalog allows large n to exhaust memory and cause denial of service.

Reporter	Title	Published	Views	Family All 103
IBM Security Bulletins	Security Bulletin: Vulnerabilities in GoLang Go and Kubernetes affect IBM watsonx.data	18 Sep 202416:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Distribution	27 Sep 202321:07	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple operator framework security vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak	11 Jul 202317:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data Scheduling is affected by opm vulnerability ( CVE-2023-2253 )	6 Dec 202315:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities found in Java, Node.js and IBM WebSphere Application Server Liberty	13 Mar 202503:39	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for September 2023	5 Oct 202308:42	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for July 2023	28 Jul 202307:30	–	ibm
IBM Security Bulletins	Security Bulletin: Mutiple vulnerabilties affecting Watson Machine Learning Accelerator on Cloud Pak for Data	12 Dec 202317:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable to denial of service due to github.com/docker/distribution ( CVE-2023-2253 )	8 Aug 202414:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager September 2023 - Multiple CVEs addressed	28 Sep 202307:41	–	ibm

Vulners

Node

OR

microsoft cbl2_cert-manager_1.11.2-14Range<1.11.2-14

microsoft cbl2_helm_3.13.2-1Range<3.13.2-1

13 Aug 2026 06:23Current

6Medium risk

Vulners AI Score6

CVSS 3.16.5

EPSS0.00938

SSVC

v2/_catalog maximum records memory exhaustion denial of service distribution endpoint