GHSA-685W-Q87J-WQW3 Distribution: Client `manifests.Get()` does not verify returned content against requested digest

Summary registry/client.manifests.Getctx, dgst, … fetches a manifest by digest but never hashes the returned body and compares it against the requested digest. A malicious or compromised registry, or any MITM on the registry connection, can serve arbitrary manifest bytes in response to a...

Distribution: Client `manifests.Get()` does not verify returned content against requested digest

Summary registry/client.manifests.Getctx, dgst, … fetches a manifest by digest but never hashes the returned body and compares it against the requested digest. A malicious or compromised registry, or any MITM on the registry connection, can serve arbitrary manifest bytes in response to a...

EUVD-2026-99225

Distribution: Client manifests.Get does not verify returned content against requested digest...

CVE-2026-85747

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.manifests.Get reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a...

Linux Distros Unpatched Vulnerability : CVE-2026-85747

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.manifests.Get reads a manifest returned for a...

DEBIAN-CVE-2026-85747

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.manifests.Get reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a...

CVE-2026-85747

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.manifests.Get reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the Get method of the manifests type in registry/client/repository.go, which reads the response body and passes it to distribution.UnmarshalManifest without computing digest.FromBytesbody...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the Get method of the manifests type in registry/client/repository.go, which reads the response body and passes it to distribution.UnmarshalManifest without computing digest.FromBytesbody...

CVE-2026-85747 Distribution: Client `manifests.Get()` does not verify returned content against requested digest

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.manifests.Get reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a...

CVE-2026-85747

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.manifests.Get reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a...

CVE-2026-85747 Distribution: Client `manifests.Get()` does not verify returned content against requested digest

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.manifests.Get reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a...

CVE-2026-85747

Distribution , a toolkit for handling container content, is vulnerable in versions prior to 3.1.2 . The registry/client.(*manifests).Get() function fails to verify returned content against a requested digest during digest-pinned requests, allowing a malicious or intercepted registry response to s...

PT-2026-111868

Name of the Vulnerable Software and Affected Versions Distribution versions prior to 3.1.2 Description The registry/client.manifests.Get function reads a manifest for a digest-pinned request and passes it to distribution.UnmarshalManifest without verifying the body against the requested digest...