CVE-2017-11468: Docker Registry Allocation of Resources Without Limits or Throttling
Summary
CVE-2017-11468: Docker Registry has Allocation of Resources Without Limits or Throttling. Affects github.com/docker/distribution versions < 2.7.0-rc.0. Fixed in 2.7.0-rc.0. How to fix ↓
Also tracked for
- docker-registry · Debian:11
The same CVE-2017-11468 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Docker Registry is a component of Docker Distribution that allows users to store and distribute Docker images. It provides a central repository for Docker images, enabling efficient sharing and deployment of containerized applications. The Docker Registry is implemented in Go and consists of various packages, including 'github.com/docker/distribution/registry/handlers' and 'github.com/docker/distribution/registry/storage'. This vulnerability affects Docker Registry versions prior to 2.6.2.
Vulnerability Detail
The Docker Registry in Docker Distribution does not properly restrict the amount of content accepted from a user. This lack of limitation allows remote attackers to exploit the 'manifest' endpoint, causing a denial of service by consuming excessive memory. By sending specially crafted requests, an attacker can overwhelm the Docker Registry, leading to a complete exhaustion of system resources. This vulnerability has a CVSSv3 score of 7.5, indicating a high severity level.
How To Fix
Latest published version: v2.8.3+incompatible as of 22 Oct 2026
go get github.com/docker/distribution@v2.8.3+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.7.0-rc.0
This is the first release that contains the fix.
go get github.com/docker/distribution@v2.7.0-rc.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version to mitigate the risk of a denial of service attack.
Conclusion
The Docker Registry vulnerability (CVE-2017-11468) in Docker Distribution allows remote attackers to cause a denial of service by consuming excessive memory. To mitigate this risk, it is recommended to upgrade Docker Registry to version 2.7.0-rc.0 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/docker/distribution →
FAQ
Docker Registry is a component of Docker Distribution that provides a central repository for storing and distributing Docker images.
This vulnerability allows remote attackers to cause a denial of service by consuming excessive memory, leading to a complete exhaustion of system resources.
The CVSSv3 score of this vulnerability is 7.5, indicating a high severity level.
To fix this vulnerability, upgrade Docker Registry to version 2.7.0-rc.0 or later.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/distribution.
