CVE-2026-85747
Fixed in a distro release EPSS <1%CVSS 6.8
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a malicious or intercepted registry response to substitute attacker-chosen manifest content even when Docker-Content-Digest claims the requested value. The bundled pull-through proxy in registry/proxy/proxymanifeststore.go can cache and re-serve the substituted manifest. This issue is fixed in version 3.1.2.
Products: distribution
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/distribution/distribution/v3 | 3.1.2 |
| Go | github.com/docker/distribution | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | argo-workflow-controller-3.7 | no fix |
| Chainguard | argo-workflow-controller-4.0 | no fix |
| Chainguard | argo-workflow-controller-fips-3.7 | no fix |
| Chainguard | argo-workflow-controller-fips-4.0 | no fix |
| Chainguard | argocd-image-updater | 1.3.1-r3 |
| Chainguard | argocd-image-updater-fips | 1.3.1-r2 |
| Chainguard | buildah | 0 |
| Chainguard | buildah-fips | no fix |
| Chainguard | buildah-fips | 0 |
| Chainguard | chainloop-artifact-cas | no fix |
| Chainguard | chainloop-artifact-cas-fips | no fix |
| Chainguard | chainloop-control-plane | no fix |
| Chainguard | chainloop-control-plane-fips | no fix |
| Chainguard | commercial-chainloop-backend | no fix |
| Chainguard | commercial-chainloop-cli | no fix |
| Chainguard | commercial-gitlab-rails-ee-19.1 | no fix |
| Chainguard | commercial-gitlab-rails-ee-19.2 | no fix |
| Chainguard | commercial-gitlab-rails-ee-19.3 | no fix |
| Chainguard | commercial-gitlab-rails-ee-19.4 | no fix |
| Chainguard | commercial-gitlab-rails-ee-19.5 | no fix |
| Chainguard | commercial-gitlab-rails-ee-fips-19.1 | no fix |
| Chainguard | commercial-gitlab-rails-ee-fips-19.2 | no fix |
| Chainguard | commercial-gitlab-rails-ee-fips-19.3 | no fix |
| Chainguard | commercial-gitlab-rails-ee-fips-19.4 | no fix |
| Chainguard | commercial-gitlab-rails-ee-fips-19.5 | no fix |
| Chainguard | commercial-kyverno-1.14 | no fix |
| Chainguard | commercial-kyverno-1.15 | no fix |
| Chainguard | commercial-kyverno-1.16 | no fix |
| Chainguard | commercial-kyverno-background-controller-1.14 | no fix |
| Chainguard | commercial-kyverno-background-controller-1.15 | no fix |
| Chainguard | commercial-kyverno-background-controller-1.16 | no fix |
| Chainguard | commercial-kyverno-cleanup-controller-1.14 | no fix |
| Chainguard | commercial-kyverno-cleanup-controller-1.15 | no fix |
| Chainguard | commercial-kyverno-cleanup-controller-1.16 | no fix |
| Chainguard | commercial-kyverno-reports-controller-1.14 | no fix |
| Chainguard | commercial-kyverno-reports-controller-1.15 | no fix |
| Chainguard | commercial-kyverno-reports-controller-1.16 | no fix |
| Chainguard | commercial-kyvernopre-1.14 | no fix |
| Chainguard | commercial-kyvernopre-1.15 | no fix |
| Chainguard | commercial-kyvernopre-1.16 | no fix |
| Chainguard | cosmo-router | no fix |
| Chainguard | cosmo-router-fips | no fix |
| Chainguard | crossplane-function-kcl | 0 |
| Chainguard | crossplane-function-kcl-fips | no fix |
| Chainguard | dagdotdev | no fix |
| Chainguard | datadog-agent-7.78 | no fix |
| Chainguard | datadog-agent-7.79 | no fix |
| Chainguard | datadog-agent-fips-7.78 | no fix |
| Chainguard | datadog-agent-fips-7.79 | no fix |
| Chainguard | docker-cli-fips | no fix |
| Chainguard | dockerd-28 | no fix |
| Chainguard | dockerd-29 | no fix |
| Chainguard | dockerd-fips-28 | no fix |
| Chainguard | dockerd-fips-29 | no fix |
| Chainguard | drone | 0 |
| Chainguard | drone | 3.3.0-r30 |
| Chainguard | drone-fips | 3.3.0-r29 |
| Chainguard | drone-fips | 0 |
| Chainguard | envoy-gateway-1.6 | no fix |
| Chainguard | envoy-gateway-1.6-egctl | no fix |
| Chainguard | envoy-gateway-fips-1.6 | no fix |
| Chainguard | envoy-gateway-fips-1.6-egctl | no fix |
| Chainguard | falco-no-driver | 0 |
| Chainguard | flux-2.6 | no fix |
| Chainguard | flux-2.7 | no fix |
| Chainguard | flux-2.8 | no fix |
| Chainguard | flux-fips-2.6 | no fix |
| Chainguard | flux-fips-2.7 | no fix |
| Chainguard | flux-fips-2.8 | no fix |
| Chainguard | gatekeeper-3.21-gator | no fix |
| Chainguard | gitlab-rails-ce-18.11 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | no fix |
| Chainguard | gitlab-rails-ce-19.1 | no fix |
| Chainguard | gitlab-rails-ce-19.2 | no fix |
| Chainguard | gitlab-rails-ce-19.3 | 0 |
| Chainguard | gitlab-rails-ce-19.4 | 0 |
| Chainguard | gitlab-rails-ce-19.5 | 0 |
| Chainguard | gitlab-rails-ce-fips-18.10 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.11 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.9 | no fix |
| Chainguard | gitlab-rails-ce-fips-19.0 | no fix |
| Chainguard | gitlab-rails-ce-fips-19.1 | no fix |
| Chainguard | gitlab-rails-ce-fips-19.2 | no fix |
| Chainguard | gitlab-rails-ce-fips-19.3 | 0 |
| Chainguard | gitlab-rails-ce-fips-19.4 | 0 |
| Chainguard | gitlab-rails-ce-fips-19.5 | 0 |
| Chainguard | gitlab-runner-19.2 | no fix |
| Chainguard | gitlab-runner-19.3 | 0 |
| Chainguard | gitlab-runner-fips-19.2 | no fix |
| Chainguard | gitlab-runner-fips-19.3 | 0 |
| Chainguard | gitlab-runner-helper-19.2 | no fix |
| Chainguard | gitlab-runner-helper-19.3 | 0 |
| Chainguard | gitlab-runner-helper-fips-19.2 | no fix |
| Chainguard | gitlab-runner-helper-fips-19.3 | 0 |
| Chainguard | gitness | 3.3.0-r46 |
| Chainguard | gitness | 0 |
| Chainguard | go-sqlcmd | no fix |
| Chainguard | google-osconfig-agent | no fix |
| Chainguard | harbor-scanner-trivy | 0 |
| Chainguard | harbor-scanner-trivy-fips | 0 |
| Chainguard | incert | no fix |
| Chainguard | k3d | no fix |
| Chainguard | k3s-1.31 | no fix |
| Chainguard | k3s-1.32 | no fix |
| Chainguard | k3s-1.33 | no fix |
| Chainguard | k3s-1.34 | 0 |
| Chainguard | k3s-1.35 | 0 |
| Chainguard | k3s-1.36 | 0 |
| Chainguard | k3s-1.37 | 0 |
| Chainguard | k3s-fips-1.33 | 0 |
| Chainguard | k3s-fips-1.34 | 0 |
| Chainguard | k3s-fips-1.35 | 0 |
| Chainguard | k3s-fips-1.36 | 0 |
| Chainguard | k3s-fips-1.37 | 0 |
| Chainguard | k3s-static-1.31 | no fix |
| Chainguard | k3s-static-1.32 | no fix |
| Chainguard | k3s-static-1.33 | no fix |
| Chainguard | k3s-static-1.34 | 0 |
| Chainguard | k3s-static-1.35 | 0 |
| Chainguard | k3s-static-1.36 | 0 |
| Chainguard | k3s-static-1.37 | 0 |
| Chainguard | k8s-image-swapper | 0 |
| Chainguard | k8s-image-swapper-fips | no fix |
| Chainguard | k9s | 0 |
| Chainguard | kaniko | 0 |
| Chainguard | kaniko-fips | 0 |
| Chainguard | kaniko-warmer | 0 |
| Chainguard | kaniko-warmer-fips | 0 |
| Chainguard | kbld | no fix |
| Chainguard | kbld-fips | no fix |
| Chainguard | knative-serving-1.20-controller | no fix |
| Chainguard | knative-serving-1.21-controller | no fix |
| Chainguard | knative-serving-fips-1.20-controller | no fix |
| Chainguard | knative-serving-fips-1.21-controller | no fix |
| Chainguard | kots | 1.132.0-r6 |
| Chainguard | kots | no fix |
| Chainguard | kubedock | no fix |
| Chainguard | kubedock-fips | no fix |
| Chainguard | kubescape | no fix |
| Chainguard | kubescape-operator | no fix |
| Chainguard | kubescape-operator-fips | no fix |
| Chainguard | kubescape-server | no fix |
| Chainguard | kubescape-server-downloader | no fix |
| Chainguard | kubescape-server-fips | no fix |
| Chainguard | kubescape-server-fips-downloader | no fix |
| Chainguard | kubevela-vela-cli | 0 |
| Chainguard | kubevela-vela-cli-fips | 0 |
| Chainguard | kubevela-vela-core | 0 |
| Chainguard | kubevela-vela-core-fips | 0 |
| Chainguard | kubevirt-cdi-importer-1.6 | 0 |
| Chainguard | kubevirt-cdi-importer-fips-1.6 | 0 |
| Chainguard | kubevirt-cdi-uploadserver-1.5 | 0 |
| Chainguard | kubevirt-cdi-uploadserver-1.6 | 0 |
| Chainguard | kubevirt-cdi-uploadserver-fips-1.5 | 0 |
| Chainguard | kubevirt-cdi-uploadserver-fips-1.6 | no fix |
| Chainguard | kubevirt-cdi-uploadserver-fips-1.6 | 0 |
| Chainguard | kwokctl | no fix |
| Chainguard | manifest-tool | no fix |
| Chainguard | neuvector-controller | no fix |
| Chainguard | neuvector-controller-fips | no fix |
| Chainguard | neuvector-enforcer | no fix |
| Chainguard | neuvector-enforcer-fips | no fix |
| Chainguard | neuvector-scanner | no fix |
| Chainguard | neuvector-scanner-fips | 0 |
| Chainguard | neuvector-scanner-task | no fix |
| Chainguard | neuvector-scanner-task-fips | 0 |
| Chainguard | paranoia | no fix |
| Chainguard | podman-5.8 | no fix |
| Chainguard | podman-6.0 | no fix |
| Chainguard | podman-6.1 | 0 |
| Chainguard | podman-fips-5.8 | no fix |
| Chainguard | podman-fips-6.0 | no fix |
| Chainguard | podman-fips-6.1 | 0 |
| Chainguard | portieris | no fix |
| Chainguard | portieris-fips | no fix |
| Chainguard | prometheus-podman-exporter | no fix |
| Chainguard | prometheus-podman-exporter-fips | no fix |
| Chainguard | rancher-2.10 | no fix |
| Chainguard | rancher-2.11 | 0 |
| Chainguard | rancher-2.12 | 0 |
| Chainguard | rancher-2.13 | 0 |
| Chainguard | rancher-2.14 | 0 |
| Chainguard | rancher-2.15 | 0 |
| Chainguard | rancher-agent-2.10 | no fix |
| Chainguard | rancher-agent-2.11 | 0 |
| Chainguard | rancher-agent-2.12 | 0 |
| Chainguard | rancher-agent-2.13 | 0 |
| Chainguard | rancher-agent-2.14 | 0 |
| Chainguard | rancher-agent-2.15 | 0 |
| Chainguard | rancher-system-agent | no fix |
| Chainguard | rancher-system-upgrade-controller | 0 |
| Chainguard | rancher-system-upgrade-controller-fips | 0 |
| Chainguard | rancher-webhook-0.4 | 0 |
| Chainguard | rancher-webhook-fips-0.4 | 0 |
| Chainguard | ratify | no fix |
| Chainguard | ratify-fips | no fix |
| Chainguard | ratify-fips-licensechecker | no fix |
| Chainguard | ratify-fips-sbom | no fix |
| Chainguard | ratify-fips-schemavalidator | no fix |
| Chainguard | ratify-fips-vulnerabilityreport | no fix |
| Chainguard | ratify-licensechecker | no fix |
| Chainguard | ratify-sbom | no fix |
| Chainguard | ratify-schemavalidator | no fix |
| Chainguard | ratify-vulnerabilityreport | no fix |
| Chainguard | reports-server | 0 |
| Chainguard | rke2-cloud-provider | 0 |
| Chainguard | rke2-cloud-provider-fips | no fix |
| Chainguard | rke2-runtime-1.33 | no fix |
| Chainguard | rke2-runtime-1.34 | no fix |
| Chainguard | rke2-runtime-1.35 | no fix |
| Chainguard | rke2-runtime-1.36 | no fix |
| Chainguard | rke2-runtime-1.37 | no fix |
| Chainguard | rke2-runtime-fips-1.33 | no fix |
| Chainguard | rke2-runtime-fips-1.34 | no fix |
| Chainguard | rke2-runtime-fips-1.35 | no fix |
| Chainguard | rke2-runtime-fips-1.36 | no fix |
| Chainguard | rke2-runtime-fips-1.37 | no fix |
| Chainguard | skaffold | no fix |
| Chainguard | skaffold-fips | no fix |
| Chainguard | skopeo | 0 |
| Chainguard | skopeo-fips | 0 |
| Chainguard | snyk-cli | no fix |
| Chainguard | trufflehog | 0 |
| Chainguard | trufflehog-fips | 0 |
| Chainguard | undock | no fix |
| Chainguard | vcluster | no fix |
| Chainguard | vcluster-cli | no fix |
| Chainguard | vcluster-cli-fips | no fix |
| Chainguard | vcluster-fips | no fix |
| Chainguard | vcluster-syncer | no fix |
| Chainguard | vcluster-syncer-fips | no fix |
| Chainguard | vendir | no fix |
| Chainguard | vendir-fips | no fix |
| Chainguard | vitess-22-binaries | no fix |
| Chainguard | vitess-23-binaries | no fix |
| Chainguard | wazuh-manager-filebeat-oss | no fix |
| Chainguard | wazuh-manager-filebeat-oss-fips | no fix |
| Chainguard | xeol | no fix |
| Chainguard | xeol-fips | 0 |
| Debian 12 | docker-registry | no fix |
| Debian 13 | docker-registry | no fix |
| Debian 14 | docker-registry | no fix |
| Ubuntu 20.04 LTS | docker-registry | no fix |
| Ubuntu 24.04 LTS | docker-registry | no fix |
| Ubuntu 26.10 | docker-registry | no fix |
| Ubuntu Pro 16.04 LTS | docker-registry | no fix |
| Ubuntu Pro 18.04 LTS | docker-registry | no fix |
| Ubuntu Pro 22.04 LTS | docker-registry | no fix |
| Ubuntu Pro 26.04 LTS | docker-registry | no fix |
| Wolfi | argo-workflow-controller-4.0 | no fix |
| Wolfi | argocd-image-updater | 1.3.1-r3 |
| Wolfi | buildah | 0 |
| Wolfi | dagdotdev | no fix |
| Wolfi | datadog-agent-7.78 | no fix |
| Wolfi | datadog-agent-7.79 | no fix |
| Wolfi | dockerd-28 | no fix |
| Wolfi | dockerd-29 | no fix |
| Wolfi | falco-no-driver | 0 |
| Wolfi | flux-2.7 | no fix |
| Wolfi | flux-2.8 | no fix |
| Wolfi | gatekeeper-3.21-gator | no fix |
| Wolfi | gitlab-runner-19.2 | no fix |
| Wolfi | gitlab-runner-19.3 | 0 |
| Wolfi | gitlab-runner-helper-19.2 | no fix |
| Wolfi | gitlab-runner-helper-19.3 | 0 |
| Wolfi | gitness | 0 |
| Wolfi | gitness | 3.3.0-r46 |
| Wolfi | harbor-scanner-trivy | 0 |
| Wolfi | incert | no fix |
| Wolfi | k3d | no fix |
| Wolfi | k3s-1.32 | no fix |
| Wolfi | k3s-1.33 | no fix |
| Wolfi | k3s-1.34 | 0 |
| Wolfi | k3s-1.35 | 0 |
| Wolfi | k3s-1.36 | 0 |
| Wolfi | k3s-1.37 | 0 |
| Wolfi | k3s-static-1.32 | no fix |
| Wolfi | k3s-static-1.33 | no fix |
| Wolfi | k3s-static-1.34 | 0 |
| Wolfi | k3s-static-1.35 | 0 |
| Wolfi | k3s-static-1.36 | 0 |
| Wolfi | k3s-static-1.37 | 0 |
| Wolfi | k9s | 0 |
| Wolfi | kaniko | 0 |
| Wolfi | kaniko-warmer | 0 |
| Wolfi | kbld | no fix |
| Wolfi | knative-serving-1.21-controller | no fix |
| Wolfi | kots | 1.132.0-r6 |
| Wolfi | kots | no fix |
| Wolfi | kubescape | no fix |
| Wolfi | kubescape-operator | no fix |
| Wolfi | kubevela-vela-cli | 0 |
| Wolfi | kubevela-vela-core | 0 |
| Wolfi | kwokctl | no fix |
| Wolfi | manifest-tool | no fix |
| Wolfi | neuvector-scanner | no fix |
| Wolfi | neuvector-scanner-task | no fix |
| Wolfi | paranoia | no fix |
| Wolfi | podman-6.0 | no fix |
| Wolfi | portieris | no fix |
| Wolfi | rancher-2.13 | 0 |
| Wolfi | rancher-2.14 | 0 |
| Wolfi | rancher-agent-2.13 | 0 |
| Wolfi | rancher-agent-2.14 | 0 |
| Wolfi | rancher-system-agent | no fix |
| Wolfi | rancher-system-upgrade-controller | 0 |
| Wolfi | ratify | no fix |
| Wolfi | ratify-licensechecker | no fix |
| Wolfi | ratify-sbom | no fix |
| Wolfi | ratify-schemavalidator | no fix |
| Wolfi | ratify-vulnerabilityreport | no fix |
| Wolfi | rke2-cloud-provider | 0 |
| Wolfi | skaffold | no fix |
| Wolfi | skopeo | 0 |
| Wolfi | snyk-cli | no fix |
| Wolfi | trufflehog | 0 |
| Wolfi | undock | no fix |
| Wolfi | vcluster | no fix |
| Wolfi | vcluster-cli | no fix |
| Wolfi | vcluster-syncer | no fix |
| Wolfi | vendir | no fix |
| Wolfi | vitess-23-binaries | no fix |
| Wolfi | xeol | no fix |