CVE-2023-2253: Out-of-Memory Denial of Service in github.com/docker/distribution
Summary
CVE-2023-2253: distribution catalog API endpoint can lead to OOM via malicious user input. Affects github.com/docker/distribution versions < 2.8.2-beta.1. Fixed in 2.8.2-beta.1. How to fix ↓
Also tracked for
- docker-registry · Debian:11
- github.com/distribution/distribution · Go
- github.com/distribution/distribution · Go
The same CVE-2023-2253 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/docker/distribution is an open-source project written in Go that provides a registry for storing and distributing Docker images. It includes various API endpoints for managing and querying image metadata. The vulnerability identified as CVE-2023-2253 affects the distribution catalog API endpoint, which is responsible for returning a list of available image repositories. This vulnerability can lead to an out-of-memory (OOM) denial of service (DoS) attack when a malicious user provides a crafted input to the /v2/_catalog API endpoint.
Vulnerability Detail
The /v2/_catalog API endpoint in github.com/docker/distribution accepts a parameter n to control the maximum number of records returned. By default, if n is not provided, it uses a value of 100. However, when a malicious user provides an excessively large value for n, the server allocates an array or slice of n strings before filling it with data. This behavior can lead to an OOM condition in memory-restricted environments. The vulnerability was introduced approximately seven years ago and can result in a DoS attack on systems running distribution built after a specific commit.
How To Fix
Latest published version: v2.8.3+incompatible as of 22 Oct 2026
go get github.com/docker/distribution@v2.8.3+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.8.2-beta.1
This is the first release that contains the fix.
go get github.com/docker/distribution@v2.8.2-beta.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability without applying the patches. However, restricting access to the affected /v2/_catalog API endpoint can help mitigate the risk. It is recommended to keep this endpoint behind heightened privilege and avoid exposing it to the internet.
Conclusion
The vulnerability identified as CVE-2023-2253 in github.com/docker/distribution can lead to an out-of-memory denial of service attack when a malicious user provides a crafted input to the /v2/_catalog API endpoint. To mitigate this vulnerability, it is crucial to update to at least version 2.8.2-beta.1 or apply the necessary patches. Restricting access to the affected API endpoint is also recommended. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/docker/distribution →
FAQ
The vulnerability can lead to an out-of-memory denial of service attack on systems running github.com/docker/distribution. This can result in the unavailability of the registry and potential disruption of Docker image distribution.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground allows you to analyze your Gopkg.lock file without any signup or code access.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is important to apply the recommended patches to mitigate the risk.
Unfortunately, there are no known temporary fixes for this vulnerability. It is recommended to update to the patched versions as soon as possible.
For more information, you can open an issue in the github.com/docker/distribution repository or email the project maintainers at cncf-distribution-security@lists.cncf.io.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/distribution.
