Vulnerability Database · Go · Package report
github.com/distribution/distribution: vulnerability history, versions and safety
github.com/distribution/distribution is a package in the Go ecosystem. Vulert records 6 vulnerabilities for it across 120 releases, from May 2023 to Aug 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.
No patched version yet — these are the ones to plan around.
See the unfixed vulnerabilities →No published version shipped hostile code.
See all github.com/distribution/distribution vulnerabilities
Vulert verdict on github.com/distribution/distribution v2.8.3+incompatible i
Updated on 23 Oct 2026
Careful: v2.8.3+incompatible has 6 known vulnerabilities, and 4 have no fix yet. Use an earlier safe version, or the workaround listed for each one.
- Security Some issues to review
- Maintenance Maintaining
- Popularity Key ecosystem project
- Community Moderate
The current release has a vulnerability with no published fix, which caps this score.
What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →
- Current release v2.8.3+incompatible — affected i
- Vulnerabilities on record 6 over 3 years · 3 in the last year i
- Latest disclosure 18 Aug 2026 i
- Highest CVSS n/a i
- With no published fix 4 i
- Stars 10,658 i
- OpenSSF scorecard 6/10 i
- Last release 36 months ago i
- Licence Apache-2.0 i
Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.
Concerned about your application's security?
Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.
01 Versions
Which versions are affected
Every version Vulert tracks for github.com/distribution/distribution, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.
- v2.8.4-0.20260923142519-db037680f2ac+incompatible 23 Sep 2026
- v2.8.4-0.20240111071203-5d5c60f77c01+incompatible 11 Jan 2024
- v2.8.4-0.20240106110212-bb33a43c749b+incompatible 06 Jan 2024
- v2.8.4-0.20231004140828-d607c6ccb937+incompatible 04 Oct 2023
- v2.8.3+incompatible 02 Oct 2023
- v2.8.3-0.20230914193254-da05539ad316+incompatible 14 Sep 2023
- v2.8.3-0.20230822141059-27206bcd3b9b+incompatible 22 Aug 2023
- v0.0.0-20230511101157-7c354a4b40fe 11 May 2023
- v2.8.2+incompatible 11 May 2023
- v0.0.0-20230509231638-320d6a141f17 09 May 2023
- v2.8.2-beta.2+incompatible 09 May 2023
- v0.0.0-20230509213959-963c19952adf 09 May 2023
- v2.8.2-beta.1+incompatible 09 May 2023
- v0.0.0-20220308175236-b5ca020cfbe9 08 Mar 2022
- v2.8.1+incompatible 08 Mar 2022
- v2.8.1-0.20220308171510-1b5f094086fc+incompatible 08 Mar 2022
- v0.0.0-20220207154021-dcf66392d606 07 Feb 2022
- v0.0.0-20220121124632-212b38ed225e 21 Jan 2022
- v2.8.0+incompatible 21 Jan 2022
- v2.8.0-beta.1+incompatible 21 Jan 2022
- v2.7.2-0.20220113165637-1840415ca85b+incompatible 13 Jan 2022
- v2.7.2-0.20211222091332-1ddad0bad8c5+incompatible 22 Dec 2021
- v2.7.2-0.20211105171609-10ade61de947+incompatible 05 Nov 2021
- v2.7.2-0.20210908134447-691e62e7eff1+incompatible 08 Sep 2021
- v2.7.2-0.20210908132407-19b573a6f771+incompatible 08 Sep 2021
- v2.7.2-0.20210323152304-18230b7b345a+incompatible 23 Mar 2021
- v2.7.2-0.20210323130320-09109ab50a52+incompatible 23 Mar 2021
- v2.7.2-0.20210201030454-f1bd6551199b+incompatible 01 Feb 2021
- v2.7.2-0.20200310143531-0a1e4a57e241+incompatible 10 Mar 2020
- v2.7.2-0.20190903190826-269d18d9a86f+incompatible 03 Sep 2019
- v2.7.1-0.20190605223428-dcfe05ce6cff+incompatible 05 Jun 2019
- v2.7.1-0.20190604190418-8f9c8094fbe6+incompatible 04 Jun 2019
- v2.7.1-0.20190509121758-0e2d080a8a86+incompatible 09 May 2019
- v2.7.1-0.20190417014306-3226863cbcba+incompatible 17 Apr 2019
- v2.7.1-0.20190414100559-5afbf324000f+incompatible 14 Apr 2019
- v2.7.1-0.20190405192020-74f429a5ad40+incompatible 05 Apr 2019
- v2.7.1-0.20190319070602-51bb5cee5b6a+incompatible 19 Mar 2019
- v2.7.1-0.20190318033546-fd77cf43a692+incompatible 18 Mar 2019
- v2.7.1-0.20190315200521-c18c6c33b240+incompatible 15 Mar 2019
- v2.7.1-0.20190308114520-f87772650309+incompatible 08 Mar 2019
- v2.7.1-0.20190305004208-6d62eb1d4a35+incompatible 05 Mar 2019
- v2.7.1-0.20190304094832-3390f32aecd3+incompatible 04 Mar 2019
- v2.7.1-0.20190304091757-ae91d1f429a2+incompatible 04 Mar 2019
- v2.7.1-0.20190304065348-6e10631d9c8b+incompatible 04 Mar 2019
- v2.7.1-0.20190302032852-e1e72e956374+incompatible 02 Mar 2019
- v2.7.1-0.20190302032852-f9a05061916d+incompatible 02 Mar 2019
- v2.7.1-0.20190301224543-d3ddc3572c11+incompatible 01 Mar 2019
- v2.7.1-0.20190301222654-c192a281f8ac+incompatible 01 Mar 2019
- v2.7.1-0.20190221231141-a683c7c235e1+incompatible 21 Feb 2019
- v2.7.1-0.20190220075421-bbc9885aa216+incompatible 20 Feb 2019
- v2.7.1-0.20190217044610-92a6436714be+incompatible 17 Feb 2019
- v2.7.1-0.20190215135517-d5a615b8c9a4+incompatible 15 Feb 2019
- v2.7.1-0.20190215131457-09a63caa37ca+incompatible 15 Feb 2019
- v2.7.1-0.20190215131457-228bafca0b41+incompatible 15 Feb 2019
- v2.7.1-0.20190215131457-76da6290b0b9+incompatible 15 Feb 2019
- v2.7.1-0.20190215131457-8b706168467e+incompatible 15 Feb 2019
- v2.7.1-0.20190213164937-ec6566c02b9c+incompatible 13 Feb 2019
- v2.7.1-0.20190211071126-3aa2a282f76b+incompatible 11 Feb 2019
- v2.7.1-0.20190205005809-0d3efadf0154+incompatible 05 Feb 2019
- v2.7.1-0.20190205004244-48818fdea7d7+incompatible 05 Feb 2019
- v2.7.1-0.20190205001921-411d6bcfd258+incompatible 05 Feb 2019
- v2.7.1-0.20190205000104-da8db4666b08+incompatible 05 Feb 2019
- v2.7.1+incompatible 17 Jan 2019
- v2.7.1-0.20190117231926-2461543d9889+incompatible 17 Jan 2019
- v2.7.1-0.20190117231029-2eab12df9b1d+incompatible 17 Jan 2019
- v2.7.1-0.20190117003737-b75069ef13a1+incompatible 17 Jan 2019
- v2.7.1-0.20190114173136-b1fd12d0c173+incompatible 14 Jan 2019
- v2.7.1-0.20190114145455-bda79219b2be+incompatible 14 Jan 2019
- v2.7.1-0.20190114090442-15b020475887+incompatible 14 Jan 2019
- v2.7.1-0.20190111231103-cdb62b2b7777+incompatible 11 Jan 2019
- v2.7.1-0.20190110035642-7df881dcbe5f+incompatible 10 Jan 2019
- v2.7.1-0.20190107185855-91b0f0559eb6+incompatible 07 Jan 2019
- v2.7.1-0.20190107182629-980d1a696b5c+incompatible 07 Jan 2019
- v2.7.1-0.20190104211120-d1abdeb62361+incompatible 04 Jan 2019
- v2.7.1-0.20190104202606-0ac367fd6bee+incompatible 04 Jan 2019
- v2.7.1-0.20190104190512-eb1a2cd911f2+incompatible 04 Jan 2019
- v2.7.1-0.20181225013216-b7839211af4f+incompatible 25 Dec 2018
- v2.7.1-0.20181225003040-90bed6712616+incompatible 25 Dec 2018
- v2.7.0+incompatible 04 Dec 2018
- v2.7.0-rc.0.0.20181130003506-08c6bbed05f0+incompatible 30 Nov 2018
- v2.7.0-rc.0.0.20181129231500-d9e12182359e+incompatible 29 Nov 2018
- v2.7.0-rc.0.0.20181128184029-63f6c1205d5d+incompatible 28 Nov 2018
- v2.6.3-0.20181128004215-0db89b2b4640+incompatible 28 Nov 2018
- v2.7.0-rc.0.0.20181127234825-aa985ba8897a+incompatible 27 Nov 2018
- v2.7.0-rc.0.0.20181127230817-dd36fd362265+incompatible 27 Nov 2018
- v2.7.0-rc.0.0.20181101173108-1251e51ad0d8+incompatible 01 Nov 2018
- v2.7.0-rc.0.0.20181030011905-9ebf151ac2f7+incompatible 30 Oct 2018
- v2.7.0-rc.0.0.20181025215210-7c4d584e58ee+incompatible 25 Oct 2018
- v2.7.0-rc.0.0.20181024170156-93e082742a00+incompatible 24 Oct 2018
- v2.7.0-rc.0.0.20181024170101-f7046a6d689b+incompatible 24 Oct 2018
- v2.7.0-rc.0.0.20181018145419-cd1648d62cb7+incompatible 18 Oct 2018
- v2.7.0-rc.0.0.20181015224805-8a800e1292c1+incompatible 15 Oct 2018
- v2.7.0-rc.0.0.20181002220433-1cb4180b1a5b+incompatible 02 Oct 2018
- v2.7.0-rc.0.0.20181002220357-451cd548a06f+incompatible 02 Oct 2018
- v2.7.0-rc.0.0.20180929071210-6335cc258f05+incompatible 29 Sep 2018
- v0.0.0-20180928231704-17b3ff188dfd 28 Sep 2018
- v2.7.0-rc.0+incompatible 28 Sep 2018
- v2.6.0-rc.1.0.20180928230756-f08b3486c8ee+incompatible 28 Sep 2018
- v2.6.0-rc.1.0.20180927214104-f3adfea35b77+incompatible 27 Sep 2018
- v2.6.0-rc.1.0.20180927213228-e1817db8847f+incompatible 27 Sep 2018
- v2.6.0-rc.1.0.20180927122709-de8636b78cc7+incompatible 27 Sep 2018
- v2.6.0-rc.1.0.20180927013044-97cb7f35b04c+incompatible 27 Sep 2018
- v2.6.0-rc.1.0.20180926181501-06a4c2f61b6a+incompatible 26 Sep 2018
- v2.6.0-rc.1.0.20180926181501-2eb7a1722580+incompatible 26 Sep 2018
- v2.6.0-rc.1.0.20180925223416-d37f8164276c+incompatible 25 Sep 2018
- v2.6.0-rc.1.0.20180924010544-569d18aef98d+incompatible 24 Sep 2018
- v2.6.0-rc.1.0.20180921023306-2e1e6307dd43+incompatible 21 Sep 2018
- v2.6.0-rc.1.0.20180920222427-b2bd46576034+incompatible 20 Sep 2018
- v2.6.0-rc.1.0.20180920214743-f730f3ab77d0+incompatible 20 Sep 2018
- v0.0.0-20180920194744-16128bbac47f 20 Sep 2018
- v2.6.0-rc.1.0.20180920194744-16128bbac47f+incompatible 20 Sep 2018
- v2.6.0-rc.1.0.20180913220339-b089e9168825+incompatible 13 Sep 2018
- v2.6.0-rc.1.0.20180913113713-6133840f4920+incompatible 13 Sep 2018
- v2.6.0-rc.1.0.20180912215327-a927fbdb9bd6+incompatible 12 Sep 2018
- v2.6.0-rc.1.0.20180911233227-d8bde9b97ef9+incompatible 11 Sep 2018
- v2.6.0-rc.1.0.20180911231410-166874ade92a+incompatible 11 Sep 2018
- v2.6.0-rc.1.0.20180911231410-bd41413d57e6+incompatible 11 Sep 2018
- v2.6.0-rc.1.0.20180911231222-a5c2fdc5b87b+incompatible 11 Sep 2018
- v2.6.0-rc.1.0.20180911152204-9da0f07c928f+incompatible 11 Sep 2018
- v2.6.0-rc.1.0.20180911152127-877d706b3807+incompatible 11 Sep 2018
The newest 120 of 3,009 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.
02 Disclosure history
How often vulnerabilities are recorded
Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 3 of the 6 were recorded in the last 12 months.
03 Vulnerabilities
Recorded vulnerabilities for github.com/distribution/distribution
| Vulnerability | Severity | Fixed version ↓ | Disclosed ↓ |
|---|---|---|---|
| CVE-2023-2253: Open Source Vulnerability in github.com/docker/distribution | N/A unrated | 2.8.2-beta.1+incompatible | 24 May 2023 |
| CVE-2023-2253: Memory Exhaustion in github.com/distribution/distribution | N/A unrated | 2.8.2-beta.1+incompatible | 24 May 2023 |
| JWT Signing Key Injection Vulnerability in Distribution Package | N/A unrated | No fix published | 03 Mar 2025 |
| CVE-2026-33540: Credential Exfiltration Vulnerability in github.com/distribution/distribution | N/A unrated | No fix published | 25 Jun 2026 |
| CVE-2026-41888: Bypass of `storage.delete.enabled` Configuration in github.com/distribution/distribution | N/A unrated | No fix published | 25 Jun 2026 |
Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback
Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315
