{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "distribution: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/distribution--distribution/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/distribution--distribution/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-85747/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-85747/",
   "title": "CVE-2026-85747 · distribution · disclosed",
   "content_text": "Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a malicious or intercepted registry response to substitute attacker-chosen manifest content even when Docker-Content-Digest claims the requested value. The bundled pull-through proxy in registry/proxy/proxymanifeststore.go can cache and re-serve the substituted manifest. This issue is fixed in version 3.1.2.",
   "date_published": "2026-10-13T18:20:56Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-85747/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-85747/",
   "title": "CVE-2026-85747 · distribution · fixed in Chainguard (argocd-image-updater 1.3.1-r3 and 78 more)",
   "content_text": "Fixed versions: argocd-image-updater 1.3.1-r3, argocd-image-updater-fips 1.3.1-r2, buildah 0, buildah-fips 0, crossplane-function-kcl 0, drone 0, drone 3.3.0-r30, drone-fips 0, drone-fips 3.3.0-r29, falco-no-driver 0, gitlab-rails-ce-19.3 0, gitlab-rails-ce-19.4 0, gitlab-rails-ce-19.5 0, gitlab-rails-ce-fips-19.3 0, gitlab-rails-ce-fips-19.4 0, gitlab-rails-ce-fips-19.5 0, gitlab-runner-19.3 0, gitlab-runner-fips-19.3 0, gitlab-runner-helper-19.3 0, gitlab-runner-helper-fips-19.3 0, gitness 0, gitness 3.3.0-r46, harbor-scanner-trivy 0, harbor-scanner-trivy-fips 0, k3s-1.34 0, k3s-1.35 0, k3s-1.36 0, k3s-1.37 0, k3s-fips-1.33 0, k3s-fips-1.34 0, k3s-fips-1.35 0, k3s-fips-1.36 0, k3s-fips-1.37 0, k3s-static-1.34 0, k3s-static-1.35 0, k3s-static-1.36 0, k3s-static-1.37 0, k8s-image-swapper 0, k9s 0, kaniko 0, kaniko-fips 0, kaniko-warmer 0, kaniko-warmer-fips 0, kots 1.132.0-r6, kubevela-vela-cli 0, kubevela-vela-cli-fips 0, kubevela-vela-core 0, kubevela-vela-core-fips 0, kubevirt-cdi-importer-1.6 0, kubevirt-cdi-importer-fips-1.6 0, kubevirt-cdi-uploadserver-1.5 0, kubevirt-cdi-uploadserver-1.6 0, kubevirt-cdi-uploadserver-fips-1.5 0, kubevirt-cdi-uploadserver-fips-1.6 0, neuvector-scanner-fips 0, neuvector-scanner-task-fips 0, podman-6.1 0, podman-fips-6.1 0, rancher-2.11 0, rancher-2.12 0, rancher-2.13 0, rancher-2.14 0, rancher-2.15 0, rancher-agent-2.11 0, rancher-agent-2.12 0, rancher-agent-2.13 0, rancher-agent-2.14 0, rancher-agent-2.15 0, rancher-system-upgrade-controller 0, rancher-system-upgrade-controller-fips 0, rancher-webhook-0.4 0, rancher-webhook-fips-0.4 0, reports-server 0, rke2-cloud-provider 0, skopeo 0, skopeo-fips 0, trufflehog 0, trufflehog-fips 0, xeol-fips 0.",
   "date_published": "2026-10-13T18:20:56Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-85747/fixed/go",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-85747/",
   "title": "CVE-2026-85747 · distribution · fixed upstream (Go)",
   "content_text": "Fixed versions: github.com/distribution/distribution/v3 3.1.2.",
   "date_published": "2026-10-13T18:20:56Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-85747/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-85747/",
   "title": "CVE-2026-85747 · distribution · fixed in Wolfi (argocd-image-updater 1.3.1-r3 and 29 more)",
   "content_text": "Fixed versions: argocd-image-updater 1.3.1-r3, buildah 0, falco-no-driver 0, gitlab-runner-19.3 0, gitlab-runner-helper-19.3 0, gitness 0, gitness 3.3.0-r46, harbor-scanner-trivy 0, k3s-1.34 0, k3s-1.35 0, k3s-1.36 0, k3s-1.37 0, k3s-static-1.34 0, k3s-static-1.35 0, k3s-static-1.36 0, k3s-static-1.37 0, k9s 0, kaniko 0, kaniko-warmer 0, kots 1.132.0-r6, kubevela-vela-cli 0, kubevela-vela-core 0, rancher-2.13 0, rancher-2.14 0, rancher-agent-2.13 0, rancher-agent-2.14 0, rancher-system-upgrade-controller 0, rke2-cloud-provider 0, skopeo 0, trufflehog 0.",
   "date_published": "2026-10-13T18:20:56Z"
  }
 ]
}