GHSA-qq97-vm5h-rrhg

OCI Manifest Type Confusion Issue

3.0 LowFix available

Impact

Systems that rely on digest equivalence for image attestations may be vulnerable to type confusion.

Patches

Upgrade to at least v2.8.0-beta.1 if you are running v2.x release. If you use the code from the main branch, update at least to the commit after b59a6f827947f9e0e67df0cfb571046de4733586.

Workarounds

There is no way to work around this issue without patching.

References

Due to an oversight in the OCI Image Specification that removed the embedded mediaType field from manifests, a maliciously crafted OCI Container Image can cause registry clients to parse the same image in two different ways without modifying the image’s digest by modifying the Content-Type header returned by a registry. This can invalidate a common pattern of relying on container image digests for equivalence.

For more information

If you have any questions or comments about this advisory:

Open an issue in distribution
Open an issue in distribution-spec
Email us at cncf-distribution-security@lists.cncf.io

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

What each source reports

GitHub Advisories Score used3.0

OCI Manifest Type Confusion Issue

Impact

Systems that rely on digest equivalence for image attestations may be vulnerable to type confusion.

Patches

Upgrade to at least v2.8.0-beta.1 if you are running v2.x release. If you use the code from the main branch, update at least to the commit after b59a6f827947f9e0e67df0cfb571046de4733586.

Workarounds

There is no way to work around this issue without patching.

References

For more information

If you have any questions or comments about this advisory:

Open an issue in distribution
Open an issue in distribution-spec
Email us at cncf-distribution-security@lists.cncf.io

Record: GHSA-qq97-vm5h-rrhg
CVSS 3.1: 3.0 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
Weakness: CWE-843
Updated: 2026-11-02

OSV3.0

OCI Manifest Type Confusion Issue

Impact

Systems that rely on digest equivalence for image attestations may be vulnerable to type confusion.

Patches

Upgrade to at least v2.8.0-beta.1 if you are running v2.x release. If you use the code from the main branch, update at least to the commit after b59a6f827947f9e0e67df0cfb571046de4733586.

Workarounds

There is no way to work around this issue without patching.

References

For more information

If you have any questions or comments about this advisory:

Open an issue in distribution
Open an issue in distribution-spec
Email us at cncf-distribution-security@lists.cncf.io

Record: GHSA-qq97-vm5h-rrhg
CVSS 3.1: 3.0 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
Weakness: CWE-843
Updated: 2026-11-02

OSVGO-2022-0379No score

Type confusion in github.com/docker/distribution

Systems that rely on digest equivalence for image attestations may be vulnerable to type confusion.

A maliciously crafted OCI Container Image can cause registry clients to parse the same image in two different ways without modifying the image's digest, invalidating the common pattern of relying on container image digests for equivalence.

This problem has been addressed in newer versions by improving validation in manifest unmarshalling.

Record: GO-2022-0379
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/docker/distribution` Go	before 2.8.0	2.8.0
`github.com/docker/distribution` Go	before 2.8.0+incompatible	2.8.0+incompatible

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-qq97-vm5h-rrhg is a low vulnerability (CVSS 3.0) in github.com/docker/distribution, published February 8, 2022. No source lists public exploit code. Fixed in github.com/docker/distribution 2.8.0.