CVE-2017-11468: Uncontrolled resource allocation in github.com/docker/distribution
Summary
CVE-2017-11468: Uncontrolled resource allocation in github.com/docker/distribution. Affects github.com/docker/distribution versions < 2.7.0-rc.0+incompatible. Fixed in 2.7.0-rc.0+incompatible. How to fix ↓
Also tracked for
- docker-registry · Debian:11
The same CVE-2017-11468 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/docker/distribution package is a Go package that provides a registry server for storing and distributing Docker images. It offers various storage methods and handles user requests related to blob uploads, image manifests, and catalog retrieval. The package is vulnerable to uncontrolled resource allocation, where certain storage methods do not impose limits on the amount of content accepted from user requests. This vulnerability can be exploited by a malicious user to force the server to allocate an arbitrary amount of memory.
Vulnerability Detail
The uncontrolled resource allocation vulnerability in github.com/docker/distribution allows an attacker to consume excessive memory resources on the server. By sending specially crafted requests, the attacker can force the server to allocate a large amount of memory, potentially leading to denial of service (DoS) conditions. This vulnerability affects versions 0 through 2.7.0-rc.0+incompatible of the package.
How To Fix
Latest published version: v2.8.3+incompatible as of 22 Oct 2026
go get github.com/docker/distribution@v2.8.3+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.7.0-rc.0+incompatible
This is the first release that contains the fix.
go get github.com/docker/distribution@v2.7.0-rc.0+incompatibleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the package to mitigate the risk.
Conclusion
The uncontrolled resource allocation vulnerability in github.com/docker/distribution can be mitigated by updating to version 2.7.0-rc.0+incompatible or later. It is crucial to promptly apply the fix to prevent potential denial of service (DoS) attacks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/docker/distribution →
FAQ
This vulnerability can lead to excessive memory consumption on the server, potentially causing denial of service (DoS) conditions.
By sending specially crafted requests, an attacker can force the server to allocate an arbitrary amount of memory, consuming excessive resources.
Versions 0 through 2.7.0-rc.0+incompatible of the package are affected.
No, there is no known workaround. Updating to the fixed version of the package is necessary.
You can update the package by running 'go get -u github.com/docker/distribution' or by updating the package version in your go.mod file.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/distribution.
