Docker Registry has Allocation of Resources Without Limits or Throttling
High severity
GitHub Reviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Oct 2, 2023
Package
Affected versions
< 2.7.0-rc.0
Patched versions
2.7.0-rc.0
Description
Published by the National Vulnerability Database
Jul 20, 2017
Published to the GitHub Advisory Database
May 13, 2022
Reviewed
Feb 7, 2023
Last updated
Oct 2, 2023
Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.
Specific Go Packages Affected
github.com/docker/distribution/registry/storage
github.com/docker/distribution/registry/handlers
References