Every CVE Search/ Get API key

CVE-2026-33540

Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm

7.5 HighFix available

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, in pull-through cache mode, distribution discovers token auth endpoints by parsing WWW-Authenticate challenges returned by the configured upstream registry. The realm URL from a bearer challenge is used without validating that it matches the upstream registry host. As a result, an attacker-controlled upstream (or an attacker with MitM position to the upstream) can cause distribution to send the configured upstream credentials via basic auth to an attacker-controlled realm URL. This vulnerability is fixed in 3.1.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.29%Up 0.3 points since Apr 7, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, in pull-through cache mode, distribution discovers token auth endpoints by parsing WWW-Authenticate challenges returned by the configured upstream registry. The realm URL from a bearer challenge is used without validating that it matches the upstream registry host. As a result, an attacker-controlled upstream (or an attacker with MitM position to the upstream) can cause distribution to send the configured upstream credentials via basic auth to an attacker-controlled realm URL. This vulnerability is fixed in 3.1.0.

Record
CVE-2026-33540
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
EUVDEUVD-2026-19289 7.5

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, in pull-through cache mode, distribution discovers token auth endpoints by parsing WWW-Authenticate challenges returned by the configured upstream registry. The realm URL from a bearer challenge is used without validating that it matches the upstream registry host. As a result, an attacker-controlled upstream (or an attacker with MitM position to the upstream) can cause distribution to send the configured upstream credentials via basic auth to an attacker-controlled realm URL. This vulnerability is fixed in 3.1.0.

Record
EUVD-2026-19289
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-3p65-76g6-3w7r 7.5

Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm

hi guys,

commit: 40594bd98e6d6ed993b5c6021c93fdf96d2e5851 (as-of 2026-01-31) contact: GitHub Security Advisory (https://github.com/distribution/distribution/security/advisories/new)

summary

in pull-through cache mode, distribution discovers token auth endpoints by parsing WWW-Authenticate challenges returned by the configured upstream registry. the realm URL from a bearer challenge is used without validating that it matches the upstream registry host. as a result, an attacker-controlled upstream (or an attacker with MitM position to the upstream) can cause distribution to send the configured upstream credentials via basic auth to an attacker-controlled realm URL.

this is the same vulnerability class as CVE-2020-15157 (containerd), but in distribution’s pull-through cache proxy auth flow.

severity

HIGH

note: the baseline impact is credential disclosure of the configured upstream credentials. if a deployment uses broader credentials for upstream auth (for example cloud iam credentials), the downstream impact can be higher; i am not claiming this as default for all deployments.

impact

credential exfiltration of the upstream authentication material configured for the pull-through cache.

attacker starting positions that make this realistic:

  • supply chain / configuration: an operator configures a proxy cache to use an upstream that becomes attacker-controlled (compromised registry, stale domain, or a malicious mirror)
  • network: MitM on the upstream connection in environments where the upstream is reachable over insecure transport or a compromised network path

affected components

  • registry/proxy/proxyauth.go:66-81 (getAuthURLs): extracts bearer realm from upstream WWW-Authenticate without validating destination
  • internal/client/auth/session.go:485-510 (fetchToken): uses the realm URL directly for token fetch
  • internal/client/auth/session.go:429-434 (fetchTokenWithBasicAuth): sends credentials via basic auth to the realm URL

reproduction

attachment: poc.zip (local harness) with canonical and control runs.

the harness is local and does not contact a real registry: it uses two local HTTP servers (upstream + attacker token service) to demonstrate whether basic auth is sent to an attacker-chosen realm.

unzip -q -o poc.zip -d poc
cd poc
make canonical
make control

expected output (excerpt):

[CALLSITE_HIT]: getAuthURLs::configureAuth
[PROOF_MARKER]: basic_auth_sent=true realm_host=127.0.0.1 account_param=user authorization_prefix=Basic

control output (excerpt):

[CALLSITE_HIT]: getAuthURLs::configureAuth
[NC_MARKER]: realm_validation=PASS basic_auth_sent=false

suggested remediation

validate that the token realm destination is within the intended trust boundary before associating credentials with it or sending any authentication to it. one conservative option is strict same-host binding: only accept a realm whose host matches the configured upstream host.

fix accepted when

  • distribution does not send configured upstream credentials to an attacker-chosen realm URL
  • a regression test covers the canonical and blocked cases

addendum.md poc.zip PR_DESCRIPTION.md RUNNABLE_POC.md

best, oleh

Record
GHSA-3p65-76g6-3w7r
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
NVD 7.5

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, in pull-through cache mode, distribution discovers token auth endpoints by parsing WWW-Authenticate challenges returned by the configured upstream registry. The realm URL from a bearer challenge is used without validating that it matches the upstream registry host. As a result, an attacker-controlled upstream (or an attacker with MitM position to the upstream) can cause distribution to send the configured upstream credentials via basic auth to an attacker-controlled realm URL. This vulnerability is fixed in 3.1.0.

Record
CVE-2026-33540
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
OSV 7.5

Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, in pull-through cache mode, distribution discovers token auth endpoints by parsing WWW-Authenticate challenges returned by the configured upstream registry. The realm URL from a bearer challenge is used without validating that it matches the upstream registry host. As a result, an attacker-controlled upstream (or an attacker with MitM position to the upstream) can cause distribution to send the configured upstream credentials via basic auth to an attacker-controlled realm URL. This vulnerability is fixed in 3.1.0.

Record
CVE-2026-33540
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
OSVDEBIAN-CVE-2026-33540 7.5

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, in pull-through cache mode, distribution discovers token auth endpoints by parsing WWW-Authenticate challenges returned by the configured upstream registry. The realm URL from a bearer challenge is used without validating that it matches the upstream registry host. As a result, an attacker-controlled upstream (or an attacker with MitM position to the upstream) can cause distribution to send the configured upstream credentials via basic auth to an attacker-controlled realm URL. This vulnerability is fixed in 3.1.0.

Record
DEBIAN-CVE-2026-33540
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 8 moreShow less
OSVGHSA-3p65-76g6-3w7r 7.5

Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm

hi guys,

commit: 40594bd98e6d6ed993b5c6021c93fdf96d2e5851 (as-of 2026-01-31) contact: GitHub Security Advisory (https://github.com/distribution/distribution/security/advisories/new)

summary

in pull-through cache mode, distribution discovers token auth endpoints by parsing WWW-Authenticate challenges returned by the configured upstream registry. the realm URL from a bearer challenge is used without validating that it matches the upstream registry host. as a result, an attacker-controlled upstream (or an attacker with MitM position to the upstream) can cause distribution to send the configured upstream credentials via basic auth to an attacker-controlled realm URL.

this is the same vulnerability class as CVE-2020-15157 (containerd), but in distribution’s pull-through cache proxy auth flow.

severity

HIGH

note: the baseline impact is credential disclosure of the configured upstream credentials. if a deployment uses broader credentials for upstream auth (for example cloud iam credentials), the downstream impact can be higher; i am not claiming this as default for all deployments.

impact

credential exfiltration of the upstream authentication material configured for the pull-through cache.

attacker starting positions that make this realistic:

  • supply chain / configuration: an operator configures a proxy cache to use an upstream that becomes attacker-controlled (compromised registry, stale domain, or a malicious mirror)
  • network: MitM on the upstream connection in environments where the upstream is reachable over insecure transport or a compromised network path

affected components

  • registry/proxy/proxyauth.go:66-81 (getAuthURLs): extracts bearer realm from upstream WWW-Authenticate without validating destination
  • internal/client/auth/session.go:485-510 (fetchToken): uses the realm URL directly for token fetch
  • internal/client/auth/session.go:429-434 (fetchTokenWithBasicAuth): sends credentials via basic auth to the realm URL

reproduction

attachment: poc.zip (local harness) with canonical and control runs.

the harness is local and does not contact a real registry: it uses two local HTTP servers (upstream + attacker token service) to demonstrate whether basic auth is sent to an attacker-chosen realm.

unzip -q -o poc.zip -d poc
cd poc
make canonical
make control

expected output (excerpt):

[CALLSITE_HIT]: getAuthURLs::configureAuth
[PROOF_MARKER]: basic_auth_sent=true realm_host=127.0.0.1 account_param=user authorization_prefix=Basic

control output (excerpt):

[CALLSITE_HIT]: getAuthURLs::configureAuth
[NC_MARKER]: realm_validation=PASS basic_auth_sent=false

suggested remediation

validate that the token realm destination is within the intended trust boundary before associating credentials with it or sending any authentication to it. one conservative option is strict same-host binding: only accept a realm whose host matches the configured upstream host.

fix accepted when

  • distribution does not send configured upstream credentials to an attacker-chosen realm URL
  • a regression test covers the canonical and blocked cases

addendum.md poc.zip PR_DESCRIPTION.md RUNNABLE_POC.md

best, oleh

Record
GHSA-3p65-76g6-3w7r
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
OSVUBUNTU-CVE-2026-33540 7.5

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, in pull-through cache mode, distribution discovers token auth endpoints by parsing WWW-Authenticate challenges returned by the configured upstream registry. The realm URL from a bearer challenge is used without validating that it matches the upstream registry host. As a result, an attacker-controlled upstream (or an attacker with MitM position to the upstream) can cause distribution to send the configured upstream credentials via basic auth to an attacker-controlled realm URL. This vulnerability is fixed in 3.1.0.

Record
UBUNTU-CVE-2026-33540
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGO-2026-5094 No score

Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm in github.com/distribution/distribution

Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm in github.com/distribution/distribution

Record
GO-2026-5094
Updated
2026-11-02
OSVopenSUSE-SU-2026:10631-1 No score

distribution-registry-3.1.0-1.1 on GA media

These are all security issues fixed in the distribution-registry-3.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10631-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20686-1 No score

Security update for distribution

This update for distribution fixes the following issues

Security issues:

  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260283).
  • CVE-2026-33540: information disclosure via improper validation of authentication realm URL (bsc#1261793).
  • CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262951).
  • CVE-2026-35172: information disclosure via stale references after content deletion (bsc#1262096).

Non security issues:

  • add distribution-registry.tmpfiles (jsc#PED-14747).
  • distribution builds against go1.24 EOL (bsc#1259718).

Changes for distribution:

  • update to 3.1.0
  • Adds support for tag pagination
  • Fixes default credentials in Azure storage provider
  • Drops support for go1.23 and go1.24 and updates to go1.25
  • See the full changelog below for the full list of changes.
  • docs: Update to refer to new image tag v3
  • Fix default_credentials in azure storage provider
  • chore: make function comment match function name
  • build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 in the go_modules group across 1 directory
  • fix: implement JWK thumbprint for Ed25519 public keys
  • fix: Annotate code block from validation.indexes configuration docs
  • feat: extract redis config to separate struct
  • Fix: resolve issue #4478 by using a temporary file for non- append writes
  • build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2
  • docs: Add note about OTEL_TRACES_EXPORTER
  • fix: set OTEL traces to disabled by default
  • Fix markdown syntax for OTEL traces link in docs
  • Switch UUIDs to UUIDv7
  • refactor: replace map iteration with maps.Copy/Clone
  • s3-aws: fix build for 386
  • docs: Add OpenTelemetry links to quickstart docs
  • Fix S3 driver loglevel param
  • Fixed data race in TestSchedule test
  • Fixes #4683 - uses X/Y instead of Gx/Gy for thumbprint of ecdsa keys
  • build(deps): bump actions/checkout from 4 to 5
  • Fix broken link to Docker Hub fair use policy
  • fix(registry/handlers/app): redis CAs
  • build(deps): bump actions/labeler from 5 to 6
  • build(deps): bump actions/setup-go from 5 to 6
  • build(deps): bump actions/upload-pages-artifact from 3 to 4
  • build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3
  • build(deps): bump github/codeql-action from 3.26.5 to 4.30.7
  • build(deps): bump github/codeql-action from 4.30.7 to 4.30.8
  • chore: labeler: add area/client mapping for internal/client/**
  • client: add Accept headers to Exists() HEAD
  • feat(registry): Make graceful shutdown test robust
  • fix(registry): Correct log formatting for upstream challenge
  • build(deps): bump github/codeql-action from 4.30.8 to 4.30.9
  • build(deps): bump github/codeql-action from 4.30.9 to 4.31.3
  • refactor: remove redundant variable declarations in for loops
  • "should" -> "must" regarding redis eviction policy
  • build(deps): bump actions/checkout from 5 to 6
  • Incorrect warning hint
  • Add return error when list object
  • build(deps): bump actions/checkout from 5.0.1 to 6.0.0
  • build(deps): bump peter-evans/dockerhub-description from 4 to 5
  • fix: Logging regression for manifest HEAD requests
  • Add boolean parsing util
  • Expose useFIPSEndpoint for S3
  • Add Cloudfleet Container Registry to adopters
  • fix(ci): Fix broken Azure e2e storage tests
  • BUG: Fix notification filtering to work with actions when mediatypes is empty
  • build(deps): bump actions/checkout from 6.0.0 to 6.0.1
  • build(deps): bump actions/upload-artifact from 4.6.2 to 6.0.0
  • build(deps): bump github/codeql-action from 4.31.3 to 4.31.10
  • build(deps): bump github/codeql-action from 4.31.10 to 4.32.2
  • build(deps): bump actions/checkout from 6.0.1 to 6.0.2
  • update golangci-lint to v2.9 and fix linting issues
  • update to go1.25.7, alpine 3.23, xx v1.9.0
  • vendor: github.com/sirupsen/logrus v1.9.4
  • vendor: update golang.org/x/* dependencies …
Record
openSUSE-SU-2026:20686-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21483-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj
  • GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c
  • GO-2026-5102 CVE-2026-45021 GHSA-3vcp-chfh-f6r2
  • GO-2026-5272 CVE-2026-40938 GHSA-94jr-7pqp-xhcq
  • GO-2026-5486 CVE-2026-40924 GHSA-m2cx-gpqf-qf74
  • GO-2026-5542 CVE-2026-40090 GHSA-pj97-4p9w-gx3q
  • GO-2026-5630 CVE-2026-25542 GHSA-rmx9-2pp3-xhcr
  • GO-2026-5643 CVE-2026-40923 GHSA-rx35-6rhx-7858
  • GO-2026-5675 CVE-2026-41492 GHSA-vvf7-6rmr-m29q
  • GO-2026-5711 CVE-2026-40161 GHSA-wjxp-xrpv-xpff
  • GO-2026-5746 CVE-2026-41567 GHSA-x86f-5xw2-fm2r
  • GO-2026-5749 CVE-2026-41328 GHSA-x92x-px7w-4gx4
  • GO-2026-5837 CVE-2026-44840 GHSA-q2m9-6jp9-c6mc
  • GO-2026-5929 CVE-2026-44342 GHSA-26v7-h57m-gh9m
  • GO-2026-5930 CVE-2026-33655 GHSA-6qcr-qxgr-m7fv
  • GO-2026-5933 GHSA-3g4q-2f67-2gvh
  • GO-2026-5934 GHSA-59qp-cfj3-rp64
  • GO-2026-5935 GHSA-7856-g3gv-9wq8
  • GO-2026-5936 CVE-2026-53552 GHSA-26rh-24rg-j3vv
  • GO-2026-5937 CVE-2026-53508 GHSA-2jcc-mxv7-p3f9
  • GO-2026-5938 CVE-2026-53553 GHSA-4g5x-hcwm-82jw
  • GO-2026-5939 CVE-2026-10517 GHSA-698x-9w2p-7vvp
  • GO-2026-5940 CVE-2026-53572 GHSA-6w3m-4hhp-775q
  • GO-2026-5941 CVE-2026-53487 GHSA-gvhc-wv3v-7pf8
  • GO-2026-5942 CVE-2026-46600
  • GO-2026-5944 CVE-2026-50197 GHSA-659f-rgp5-w4wf
  • GO-2026-5945 CVE-2026-6815 GHSA-rmxx-v9rj-vpvg
  • GO-2026-5946 CVE-2026-52831 GHSA-v5px-423j-pf7p
  • GO-2026-5947 CVE-2026-53649 GHSA-xqhv-chqm-fhcc
  • GO-2026-5948 CVE-2026-50554 GHSA-588f-fvcv-xhvf
  • GO-2026-5949 CVE-2026-50553 GHSA-rqrh-8wpv-x7hh
  • GO-2026-5950 CVE-2026-53602 GHSA-339v-266x-79xr
  • GO-2026-5951 CVE-2026-10219 GHSA-6jm8-4fhr-5w64
  • GO-2026-5952 CVE-2026-49834 GHSA-9vcr-p3rj-q5q6
  • GO-2026-5953 CVE-2026-9094 GHSA-c9w5-qp6m-m395
  • GO-2026-5956 CVE-2026-55252 GHSA-h5g6-xmh4-hc37
  • GO-2026-5957 CVE-2026-54158 GHSA-5xfx-xj4h-5p7r
  • GO-2026-5958 CVE-2026-54068 GHSA-gcm7-57gf-953c
  • GO-2026-5959 CVE-2026-54072 GHSA-h29v-hj44-q8cv
  • GO-2026-5961 CVE-2026-54069 GHSA-hvr9-72v2-fff3
  • GO-2026-5962 CVE-2026-54088 GHSA-m93h-4hw7-5qcm
  • GO-2026-5963 CVE-2026-54067 GHSA-mvjr-vv3c-w4qv
  • GO-2026-5964 CVE-2026-54066 GHSA-p4m3-mgmm-c664
  • GO-2026-5965 CVE-2026-54070 GHSA-w7cg-whh7-xp28
  • GO-2026-5966 CVE-2026-54089 GHSA-xqp3-jq6g-x3qm
  • GO-2026-5967 CVE-2026-50551 GHSA-56mp-4f3v-fgj2
  • GO-2026-5968 CVE-2026-54174 GHSA-fpg8-7664-jc5q
  • GO-2026-5969 GHSA-g936-7jqj-mwv8
  • GO-2026-5970 CVE-2026-56852
  • GO-2026-5973 CVE-2026-54250 GHSA-jxr7-mqhw-9p98
  • GO-2026-5974 CVE-2026-44300 GHSA-wmj8-9953-vff5
  • GO-2026-5975 CVE-2026-50018 GHSA-42j2-w334-qxw7
  • GO-2026-5976 CVE-2026-50141 GHSA-g7mm-9vx7-jm7h
  • GO-2026-5977 CVE-2026-50013 GHSA-qrh4-p6v4-mrfg
  • GO-2026-5978 CVE-2026-50125 GHSA-qw5r-ppcg-f8rj
  • GO-2026-5979 CVE-2026-50006 GHSA-xrcf-6jh3-ggvx
  • GO-2026-5980 CVE-2026-50158 GHSA-2c7f-fxww-6w6c
  • GO-2026-5981 GHSA-mqxv-9rm6-w8qc
  • GO-2026-5982 GHSA-pqg7-v6wh-3pfp
  • GO-2026-5984 CVE-2026-53604 GHSA-2p2f-px33-4vv5
  • GO-2026-5985 GHSA-7rx3-5wx3-5v76
  • GO-2026-5986 CVE-2026-61699 GHSA-cm26-5974-52h8
  • GO-2026-5987 CVE-2026-55513 GHSA-g4x6-jcvr-9m3g
  • GO-2026-5988 CVE-2026-54628 GHSA-hwrq-8wxh-q4xv
  • GO-2026-5989 CVE-2026-55512 GHSA-m3cx-mwpg-32jg
  • GO-2026-5990 CVE-2026-54629 GHSA-mf78-3rpf-r784
  • GO-2026-5991 CVE-2026-53603 GHSA-q4vm-pq3q-8wgq
  • GO-2026-5992 CVE-2026-61549 GHSA-qf34-295c-26v8
  • GO-2026-5996 CVE-2026-54450 GHSA-pph6-vfjv-vpjw
  • GO-2026-5997 CVE-2026-54452 GHSA-xgch-x3mx-cm3c
  • GO-2026-5998 CVE-2026-54495 GHSA-398h-7f66-3h4p
  • GO-2026-5999 CVE-2026-10814 GHSA-jh6h-v6mp-h22v
  • GO-2026-6002 CVE-2026-58196 GHSA-pr64-jmmf-jp54
  • GO-2026-6003 CVE-2026-53714 GHSA-22xc-xg2r-9j7v
  • GO-2026-6004 CVE-2026-52833 GHSA-3v79-m2cg-89ww
  • GO-2026-6005 CVE-2026-53715 GHSA-8fv2-88gg-hm7q
  • GO-2026-6006 CVE-2026-53716 GHSA-cxpq-8v7q-cg56 *…
Record
openSUSE-SU-2026:21483-1
Updated
2026-11-02
OSVSUSE-SU-2026:21560-1 No score

Security update for distribution

This update for distribution fixes the following issues

Security issues:

  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260283).
  • CVE-2026-33540: information disclosure via improper validation of authentication realm URL (bsc#1261793).
  • CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262951).
  • CVE-2026-35172: information disclosure via stale references after content deletion (bsc#1262096).

Non security issues:

  • add distribution-registry.tmpfiles (jsc#PED-14747).
  • distribution builds against go1.24 EOL (bsc#1259718).

Changes for distribution:

  • update to 3.1.0
  • Adds support for tag pagination
  • Fixes default credentials in Azure storage provider
  • Drops support for go1.23 and go1.24 and updates to go1.25
  • See the full changelog below for the full list of changes.
  • docs: Update to refer to new image tag v3
  • Fix default_credentials in azure storage provider
  • chore: make function comment match function name
  • build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 in the go_modules group across 1 directory
  • fix: implement JWK thumbprint for Ed25519 public keys
  • fix: Annotate code block from validation.indexes configuration docs
  • feat: extract redis config to separate struct
  • Fix: resolve issue #4478 by using a temporary file for non- append writes
  • build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2
  • docs: Add note about OTEL_TRACES_EXPORTER
  • fix: set OTEL traces to disabled by default
  • Fix markdown syntax for OTEL traces link in docs
  • Switch UUIDs to UUIDv7
  • refactor: replace map iteration with maps.Copy/Clone
  • s3-aws: fix build for 386
  • docs: Add OpenTelemetry links to quickstart docs
  • Fix S3 driver loglevel param
  • Fixed data race in TestSchedule test
  • Fixes #4683 - uses X/Y instead of Gx/Gy for thumbprint of ecdsa keys
  • build(deps): bump actions/checkout from 4 to 5
  • Fix broken link to Docker Hub fair use policy
  • fix(registry/handlers/app): redis CAs
  • build(deps): bump actions/labeler from 5 to 6
  • build(deps): bump actions/setup-go from 5 to 6
  • build(deps): bump actions/upload-pages-artifact from 3 to 4
  • build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3
  • build(deps): bump github/codeql-action from 3.26.5 to 4.30.7
  • build(deps): bump github/codeql-action from 4.30.7 to 4.30.8
  • chore: labeler: add area/client mapping for internal/client/**
  • client: add Accept headers to Exists() HEAD
  • feat(registry): Make graceful shutdown test robust
  • fix(registry): Correct log formatting for upstream challenge
  • build(deps): bump github/codeql-action from 4.30.8 to 4.30.9
  • build(deps): bump github/codeql-action from 4.30.9 to 4.31.3
  • refactor: remove redundant variable declarations in for loops
  • "should" -> "must" regarding redis eviction policy
  • build(deps): bump actions/checkout from 5 to 6
  • Incorrect warning hint
  • Add return error when list object
  • build(deps): bump actions/checkout from 5.0.1 to 6.0.0
  • build(deps): bump peter-evans/dockerhub-description from 4 to 5
  • fix: Logging regression for manifest HEAD requests
  • Add boolean parsing util
  • Expose useFIPSEndpoint for S3
  • Add Cloudfleet Container Registry to adopters
  • fix(ci): Fix broken Azure e2e storage tests
  • BUG: Fix notification filtering to work with actions when mediatypes is empty
  • build(deps): bump actions/checkout from 6.0.0 to 6.0.1
  • build(deps): bump actions/upload-artifact from 4.6.2 to 6.0.0
  • build(deps): bump github/codeql-action from 4.31.3 to 4.31.10
  • build(deps): bump github/codeql-action from 4.31.10 to 4.32.2
  • build(deps): bump actions/checkout from 6.0.1 to 6.0.2
  • update golangci-lint to v2.9 and fix linting issues
  • update to go1.25.7, alpine 3.23, xx v1.9.0
  • vendor: github.com/sirupsen/logrus v1.9.4
  • vendor: update golang.org/x/* dependencies …
Record
SUSE-SU-2026:21560-1
Updated
2026-11-02
OSVSUSE-SU-2026:4212-1 No score

Security update for distribution

This update for distribution fixes the following issues:

Security issues fixed:

  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260283).
  • CVE-2026-33540: information disclosure via improper validation of authentication realm URL (bsc#1261793).
  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265788).
  • CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262951).
  • CVE-2026-35172: information disclosure via stale references after content deletion (bsc#1262096).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266629).
  • CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831, CVE-2026-39832,CVE-2026-39833,CVE-2026-39834,CVE-2026-39835,CVE-2026-42508, CVE-2026-46595,CVE-2026-46597,CVE-2026-46598: golang.org/x/crypto/ssh: multiple issues (bsc#1268884).
  • CVE-2026-41888: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265429).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272132).

Changes for distribution:

Update to 3.1.1:

  • Bounds-check the file basename in PurgeUploads Walk callback
  • Add S3 Express One Zone support to the S3 storage driver
  • Fix tag list endpoint in proxy mode
  • Clamp oversized n query parameter in proxy mode instead of returning 400
  • See the full changelog below for the full list of changes.
  • internal/client/auth/challenge: cleanups and minor refactor
  • build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp from 0.18.0 to 0.19.0 in the go_modules group across 1 directory
  • build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otl ptrace/otlptracehttp from 1.42.0 to 1.43.0 in the go_modules group across 1 directory
  • build(deps): bump github/codeql-action from 4.34.1 to 4.35.1
  • chore(build): Bump go version to latest
  • refactor: use slices.Backward to simplify the code
  • fix(proxy): fix tag list endpoint in proxy mode
  • Update docker-compose structure in deploying.md
  • build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1
  • build(deps): bump actions/upload-pages-artifact from 4.0.0 to 5.0.0
  • build(deps): bump docker/login-action from 4.0.0 to 4.1.0
  • build(deps): bump docker/bake-action from 7.0.0 to 7.1.0
  • fix(proxy): clamp oversized n query param instead of
  • feat(s3): add express zone one support to S3 driver
  • fix(storage): bounds-check the file basename in PurgeUploads Walk callback
  • chore(release): prepare for v3.1.1 release
  • Adds support for tag pagination
  • Fixes default credentials in Azure storage provider
  • Drops support for go1.23 and go1.24 and updates to go1.25
  • docs: Update to refer to new image tag v3
  • Fix default_credentials in azure storage provider
  • chore: make function comment match function name
  • build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 in the go_modules group across 1 directory
  • fix: implement JWK thumbprint for Ed25519 public keys
  • fix: Annotate code block from validation.indexes configuration docs
  • feat: extract redis config to separate struct
  • Fix: resolve issue #4478 by using a temporary file for non- append writes
  • build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2
  • docs: Add note about OTEL_TRACES_EXPORTER
  • fix: set OTEL traces to disabled by default
  • Fix markdown syntax for OTEL traces link in docs
  • Switch UUIDs to UUIDv7
  • refactor: replace map iteration with maps.Copy/Clone
  • s3-aws: fix build for 386
  • docs: Add OpenTelemetry links to quickstart docs
  • Fix S3 driver loglevel param
  • Fixed data race in TestSchedule test
  • Fixes #4683 - uses X/Y instead of Gx/Gy for thumbprint of ecdsa keys *…
Record
SUSE-SU-2026:4212-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/distribution/distribution/v3
Go
 before 3.1.0
3.1.0
github.com/distribution/distribution
Go
 through 2.8.3 None known
docker-registry
Debian:12
 All versions, plus listed versions
2.8.2+ds1-12.8.3+ds1-12.8.3+ds1-22.8.3+ds1-3
 None known
docker-registry
Debian:13
 All versions, plus listed versions
2.8.3+ds1-22.8.3+ds1-3
 None known
docker-registry
Debian:14
 before 2.8.3+ds1-3, plus listed versions
2.8.3+ds1-2
2.8.3+ds1-3
github.com/distribution/distribution
Go
 All versions None known
distribution
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
Show 17 moreShow less
Affected packages
PackageAffectedFixed
distribution
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
docker-registry
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.1.1~ds1-42.1.1~ds1-4ubuntu12.3.0~ds1-12.3.0~ds1-1ubuntu0.1~esm1
 None known
docker-registry
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.6.2~ds1-12.6.2~ds1-1ubuntu0.1~esm1
 None known
docker-registry
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.6.2~ds1-22.7.1~ds1-22.7.1~ds1-32.7.1~ds1-42.7.1+ds2-5
Show 4 moreShow less
2.7.1+ds2-72.7.1+ds2-7ubuntu0.12.7.1+ds2-7ubuntu0.22.7.1+ds2-7ubuntu0.3
 None known
docker-registry
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.7.1+ds2-7build22.8.0+ds1-42.8.0+ds1-4ubuntu0.1~esm12.8.0+ds1-4ubuntu0.1~esm22.8.0+ds1-4ubuntu0.1~esm3
 None known
docker-registry
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.8.2+ds1-1build12.8.2+ds1-1ubuntu0.24.04.12.8.2+ds1-1ubuntu0.24.04.22.8.2+ds1-1ubuntu0.24.04.3
 None known
docker-registry
Ubuntu:25.10
 All versions, plus listed versions
2.8.3+ds1-2
 None known
docker-registry
Ubuntu:26.10
 All versions, plus listed versions
2.8.3+ds1-2build12.8.3+ds1-3
 None known
docker-registry
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
2.8.3+ds1-22.8.3+ds1-2build12.8.3+ds1-2ubuntu0.26.04.1~esm1
 None known
distribution
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 3.1.0-1.1
3.1.0-1.1
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 1734 CVEs
 before 0.0.20260723T184607-160000.1.1
0.0.20260723T184607-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-33540 is a high vulnerability (CVSS 7.5) in Distribution, published April 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in github.com/distribution/distribution/v3 3.1.0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 1,556 references and the rest of 4 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open