CVE-2022-0379: Type confusion in github.com/docker/distribution
Summary
GO-2022-0379: Type confusion in github.com/docker/distribution. Affects github.com/docker/distribution versions < 2.8.0+incompatible. Fixed in 2.8.0+incompatible. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/docker/distribution is a Go package that provides a registry client and server implementation for the Docker Registry HTTP API V2. It allows users to push and pull container images from a registry. The package is widely used in the container ecosystem. However, versions prior to 2.8.0 are vulnerable to a type confusion vulnerability.
Vulnerability Detail
The type confusion vulnerability in github.com/docker/distribution allows a maliciously crafted OCI Container Image to be parsed in two different ways without modifying the image's digest. This invalidates the common pattern of relying on container image digests for equivalence. Systems that rely on digest equivalence for image attestations may be vulnerable to this issue. The vulnerability can have serious ramifications as it can lead to the execution of arbitrary code or unauthorized access to sensitive information.
How To Fix
Latest published version: v2.8.3+incompatible as of 22 Oct 2026
go get github.com/docker/distribution@v2.8.3+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.8.0+incompatible
This is the first release that contains the fix.
go get github.com/docker/distribution@v2.8.0+incompatibleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the package to mitigate the risk.
Conclusion
The type confusion vulnerability in github.com/docker/distribution can have serious consequences, including the execution of arbitrary code or unauthorized access to sensitive information. It is crucial to update to version 2.8.0 or later of the package to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/docker/distribution →
FAQ
github.com/docker/distribution is a Go package that provides a registry client and server implementation for the Docker Registry HTTP API V2. It is widely used in the container ecosystem.
The vulnerability can lead to type confusion, allowing a maliciously crafted OCI Container Image to be parsed in two different ways without modifying the image's digest. This can result in the execution of arbitrary code or unauthorized access to sensitive information.
To fix this vulnerability, update the github.com/docker/distribution package to version 2.8.0 or later. Rebuild your application to ensure it is using the patched version.
There is no known workaround for this vulnerability. Updating to the fixed version of the package is the recommended solution.
You can find more information about this vulnerability in the official vulnerability report at https://pkg.go.dev/vuln/GO-2022-0379.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/distribution.
