CVE-2024-3727: Unexpected Authenticated Registry Accesses in github.com/containers/image/v5
Summary
CVE-2024-3727: Unexpected authenticated registry accesses in github.com/containers/image/v5. Affects github.com/containers/image/v5 across 2 version ranges.
< 5.29.3
>= 5.30.0, < 5.30.1
Fixed in 5.29.3 or 5.30.1, depending on the release line you run. How to fix ↓
Also tracked for
- github.com/containers/image · Go
- golang-github-containers-image · Debian:11
The same CVE-2024-3727 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/containers/image/v5 package is a Go package that provides functionality for working with container images. It includes features for copying, manipulating, and storing container images. This package is widely used in the Go ecosystem for container-related tasks.
Vulnerability Detail
This vulnerability allows an attacker to trigger unexpected authenticated registry accesses on behalf of a victim user. This can lead to resource exhaustion, local path traversal, and other attacks. The vulnerability arises from improper access control mechanisms in the github.com/containers/image/v5 package.
How To Fix
Latest published version: v5.36.2 as of 23 Oct 2026
go get github.com/containers/image/v5@v5.36.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.29.35.29.3go get github.com/containers/image/v5@v5.29.3 -
>= 5.30.0, < 5.30.15.30.1go get github.com/containers/image/v5@v5.30.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of the github.com/containers/image/v5 package as soon as possible.
Conclusion
The github.com/containers/image/v5 package is vulnerable to unexpected authenticated registry accesses, which can lead to resource exhaustion and other attacks. It is crucial for developers to update their applications to use version 5.30.1 or later of the package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/containers/image/v5 →
FAQ
This vulnerability can lead to resource exhaustion, local path traversal, and other attacks. It can be exploited by an attacker to perform unauthorized actions on behalf of a victim user.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file and the playground will analyze it for vulnerabilities.
At the time of this report, there are no known public exploits for this vulnerability. However, it is important to update to the latest version of the github.com/containers/image/v5 package to mitigate the risk.
Yes, a patch is available in version 5.30.1 of the github.com/containers/image/v5 package. It is recommended to update to this version or later to fix the vulnerability.
This vulnerability was discovered by the security team at Vulert, a platform that monitors and alerts for open-source vulnerabilities in software.
