{"id":"CVE-2017-11468","aliases":["DEBIAN-CVE-2017-11468","EUVD-2022-4077","GHSA-h62f-wm92-2cmw","GO-2021-0072","RHSA-2017:2603","SUSE-SU-2018:0865-1","UBUNTU-CVE-2017-11468","USN-6336-1","openSUSE-SU-2020:1433-1","openSUSE-SU-2024:10723-1","openSUSE-SU-2024:12135-1"],"status":"published","title":"Docker Registry has Allocation of Resources Without Limits or Throttling","description":"Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03192,"percentile":0.88185,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2017-07-20T23:00:00Z","modified":"2026-10-20T10:48:08Z","fixes":[{"ecosystem":"Go","package":"github.com/docker/distribution","fixed_in":["2.7.0-rc.0","2.7.0-rc.0+incompatible"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"docker-registry","fixed_in":["2.6.2~ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"docker-registry","fixed_in":["2.6.2~ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"docker-registry","fixed_in":["2.6.2~ds1-1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-distribution","fixed_in":["0:2.6.2-1.git48294d9.el7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker-distribution","fixed_in":["2.6.2-13.6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"docker-registry","fixed_in":["2.3.0~ds1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP2","package":"docker-distribution","fixed_in":["2.7.1-bp152.4.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"docker-distribution-registry","fixed_in":["2.7.1-7.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"distribution-registry","fixed_in":["2.8.1-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/docker/distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-rc.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"docker-registry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2~ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"docker-registry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2~ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"docker-registry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2~ds1-1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/docker/distribution","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.7.0-rc.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/docker/distribution","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.7.0-rc.0+incompatible"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.2-1.git48294d9.el7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker-distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-13.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"docker-registry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0~ds1-1ubuntu0.1~esm1"}]}],"versions":["2.1.1~ds1-4","2.1.1~ds1-4ubuntu1","2.3.0~ds1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"docker-registry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0~ds1-1ubuntu0.1~esm1"}]}],"versions":["2.1.1~ds1-4","2.1.1~ds1-4ubuntu1","2.3.0~ds1-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"docker-registry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2~ds1-1ubuntu0.1~esm1"}]}],"versions":["2.6.2~ds1-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"docker-registry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1+ds2-7ubuntu0.3"}]}],"versions":["2.6.2~ds1-2","2.7.1~ds1-2","2.7.1~ds1-3","2.7.1~ds1-4","2.7.1+ds2-5","2.7.1+ds2-7","2.7.1+ds2-7ubuntu0.1","2.7.1+ds2-7ubuntu0.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"docker-registry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.0+ds1-4ubuntu0.1~esm2"}]}],"versions":["2.7.1+ds2-7build2","2.8.0+ds1-4","2.8.0+ds1-4ubuntu0.1~esm1"],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"docker-distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-bp152.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"docker-distribution-registry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-7.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"distribution-registry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1-1.1"}]}]}],"products":[{"vendor":"docker","product":"docker_registry"},{"vendor":"redhat","product":"enterprise_linux_server"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2017:2603","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/docker/distribution/releases/tag/v2.6.2","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/docker/distribution/pull/2340","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00047.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11468","tags":["advisory"]},{"url":"https://github.com/distribution/distribution/pull/2340","tags":["web","fix"]},{"url":"https://github.com/distribution/distribution/commit/91c507a39abfce14b5c8541cf284330e22208c0f","tags":["web","fix"]},{"url":"https://pkg.go.dev/vuln/GO-2021-0072","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h62f-wm92-2cmw"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-11468","tags":["advisory"]},{"url":"https://github.com/distribution/distribution","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1474893","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479494","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2603.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-11468","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-11468","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180865-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1033172","tags":["report"]},{"url":"https://bugzilla.suse.com/1049850","tags":["report"]},{"url":"https://bugzilla.suse.com/1083474","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11468","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-11468","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6336-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-2253","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MY76ZZYS6OXIXX3XVR5TNDLWGWIO22UJ/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-11468","description":"Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.","status":"published","published":"2017-07-20T23:00:00Z","modified":"2024-08-05T18:12:39.776Z","updated_at":"2026-11-02T14:33:20.171335Z"}],"euvd":[{"id":"EUVD-2022-4077","description":"Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.","status":"published","published":"2017-07-20T23:00:00Z","modified":"2024-08-05T18:12:39Z","updated_at":"2026-11-03T02:23:23.645757Z"}],"ghsa":[{"id":"GHSA-h62f-wm92-2cmw","title":"Docker Registry has Allocation of Resources Without Limits or Throttling","description":"Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.\n### Specific Go Packages Affected\ngithub.com/docker/distribution/registry/storage\ngithub.com/docker/distribution/registry/handlers","status":"published","published":"2022-05-13T01:16:08Z","modified":"2023-10-02T16:14:53Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:37:07.641671Z"}],"nvd":[{"id":"CVE-2017-11468","description":"Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.","status":"published","published":"2017-07-20T23:29:00.187Z","modified":"2026-06-17T01:01:51.707Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:03:54.862898Z"}],"osv":[{"id":"CVE-2017-11468","description":"Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.","status":"published","published":"2017-07-20T23:29:00.187Z","modified":"2026-10-20T10:48:08.704357884Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"DEBIAN-CVE-2017-11468","description":"Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.","status":"published","published":"2017-07-20T23:29:00.187Z","modified":"2026-09-01T20:03:41.705465019Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.50097Z"},{"id":"GHSA-h62f-wm92-2cmw","title":"Docker Registry has Allocation of Resources Without Limits or Throttling","description":"Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.\n### Specific Go Packages Affected\ngithub.com/docker/distribution/registry/storage\ngithub.com/docker/distribution/registry/handlers","status":"published","published":"2022-05-13T01:16:08Z","modified":"2023-11-08T03:58:49.599563Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:48.546324Z"},{"id":"RHSA-2017:2603","title":"Red Hat Security Advisory: docker-distribution security, bug fix, and enhancement update","status":"published","published":"2024-09-13T13:38:27Z","modified":"2026-05-13T10:36:27.08924Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2017-11468","description":"Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.","status":"published","published":"2017-07-20T23:29:00Z","modified":"2026-02-04T02:40:55.605731Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:13.729565Z"},{"id":"GO-2021-0072","title":"Uncontrolled resource allocation in github.com/docker/distribution","description":"Various storage methods do not impose limits on how much content is accepted from user requests, allowing a malicious user to force the caller to allocate an arbitrary amount of memory.","status":"published","published":"2021-04-14T20:04:52Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"openSUSE-SU-2020:1433-1","title":"Security update for docker-distribution","description":"This update for docker-distribution fixes the following issues:\n\n- Enable build on %arm (which include armv6), not only on armv7\n\n- Enable ppc64le\n\n- Use correct URL to project\n- Remove fillup, we don't ship a sysconfig file\n- Correct systemd requires\n- Enable build on ARM\n\n- Upgraded to 2.7.1\n  - Support for OCI images added\n  - Fix upgrade issues from 2.6.x\n  - Update Go version to 1.11\n  - Switch to multi-stage Dockerfile\n  - Validations enabled by default with new disabled config option\n  - Optimize health check performance\n  - Create separate permission for deleting objects in a repo\n  - Fix storage driver error propagation for manifest GETs\n  - Fix forwarded header resolution\n  - Add prometheus metrics\n  - Disable schema1 manifest by default\n  - Graceful shutdown\n  - TLS: remove ciphers that do not support perfect forward secrecy\n  - Fix registry stripping newlines from manifests\n  - Add bugsnag logrus hook\n  - Support ARM builds\n\n  This release is a special security release to address an issue allowing\n  an attacker to force arbitrarily-sized memory allocations in a registry\n  instance through the manifest endpoint. The problem has been mitigated\n  by limiting the size of reads for image manifest content.\n  Details for mitigation are in 29fa466\n  Fixes boo#1049850 (CVE-2017-11468)\n  Fixes boo#1033172\n","status":"published","published":"2020-09-14T22:22:08Z","modified":"2026-02-04T02:34:17.988391Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:10723-1","title":"docker-distribution-registry-2.7.1-7.2 on GA media","description":"These are all security issues fixed in the docker-distribution-registry-2.7.1-7.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:00:50.941647Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:12135-1","title":"distribution-registry-2.8.1-1.1 on GA media","description":"These are all security issues fixed in the distribution-registry-2.8.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:59:57.624328Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2018:0865-1","title":"Security update for docker-distribution","description":"This update for docker-distribution fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2017-11468: Fixed a denial of service (memory consumption) via the manifest endpoint (bsc#1049850).\n\nBug fixes:\n\n- bsc#1083474: docker-distirbution-registry overwrites configuration file with update.\n- bsc#1033172: Garbage collector needed - or kindly release docker-distribution-registry in Version 2.4.\n- Add SuSEfirewall2 service file for TCP port 5000.\n","status":"published","published":"2018-04-03T16:42:58Z","modified":"2026-02-04T04:13:00.100365Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"USN-6336-1","title":"docker-registry vulnerabilities","description":"It was discovered that Docker Registry incorrectly handled certain crafted\ninput, A remote attacker could possibly use this issue to cause a denial\nof service. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-11468)\n\nIt was discovered that Docker Registry incorrectly handled certain crafted\ninput. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2023-2253)\n","status":"published","published":"2023-09-05T08:44:29Z","modified":"2026-06-25T13:32:17.719687138Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}