CVE-2023-2253: Open Source Vulnerability in github.com/docker/distribution
Summary
CVE-2023-2253: Memory exhaustion in github.com/distribution/distribution. Affects github.com/distribution/distribution versions < 2.8.2-beta.1+incompatible. Fixed in 2.8.2-beta.1+incompatible. How to fix ↓
Also tracked for
- docker-registry · Debian:11
- github.com/docker/distribution · Go
The same CVE-2023-2253 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/docker/distribution package is written in Go and is used for managing and distributing container images. It provides an API endpoint called /v2/_catalog which is used for registry syncs with search or other API systems. This endpoint is designed to handle large amounts of data, but a vulnerability exists that can lead to a denial of service (DoS) attack when a malicious user provides a crafted request to this endpoint.
Vulnerability Detail
The vulnerability in github.com/docker/distribution arises from the /v2/_catalog API endpoint accepting a parameter n to control the maximum number of records returned. By default, n is set to 100. However, when a malicious user provides a large value for n, the server allocates an array/slice of n strings before filling it with data. This can lead to an out-of-memory (OOM) condition on memory-restricted environments. The vulnerability was introduced in a commit made approximately 7 years ago. Exploiting this vulnerability can result in a DoS attack on systems running distribution built after a specific commit.
How To Fix
Latest published version: v2.8.3+incompatible as of 22 Oct 2026
go get github.com/distribution/distribution@v2.8.3+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.8.2-beta.1+incompatible
This is the first release that contains the fix.
go get github.com/distribution/distribution@v2.8.2-beta.1+incompatibleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability without patching. However, restricting access to the affected /v2/_catalog API endpoint can help mitigate the risk. This can be done by implementing access controls and ensuring only authorized users or systems can access this endpoint.
Conclusion
In conclusion, the github.com/docker/distribution package is vulnerable to a denial of service (DoS) attack through a crafted request to the /v2/_catalog API endpoint. Upgrading to the recommended versions or commits and implementing access controls can help mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/distribution/distribution →
FAQ
The vulnerability can lead to a denial of service (DoS) attack on systems running github.com/docker/distribution. It can cause an out-of-memory (OOM) condition in memory-restricted environments, potentially rendering the system unresponsive.
To fix this vulnerability, you should upgrade to at least version 2.8.2-beta.1 if you are using the v2.8.x release. If you are using the main branch, update to a commit after f55a6552b006a381d9167e328808565dd2bf77dc. These updates include patches to address the vulnerability and prevent the OOM condition.
There is no known workaround for this vulnerability without patching. However, you can mitigate the risk by restricting access to the /v2/_catalog API endpoint and ensuring only authorized users or systems can access it.
Yes, the faulty commit can be found at https://github.com/distribution/distribution/blob/b7e26bac741c76cb792f8e14c41a2163b5dae8df/registry/handlers/catalog.go#L45.
For more information, you can open an issue in the https://github.com/distribution/distribution or email the team at mailto:cncf-distribution-security@lists.cncf.io.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/distribution/distribution.
