distribution has 4 CVEs on record. 1 was published in the last 90 days. The median CVSS is 7.5 (high). Most affected products: distribution (2), github.com/distribution/distribution/v3 (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 1 prev 1
Products
- distribution 2
- github.com/distribution/distribution/v3 2
Worst active — by depth score
CVE-2026-35172High· 7.5Distribution is a toolkit to pack, ship, store, and deliver container content53CVE-2026-85747Medium· 6.8Distribution is a toolkit to pack, ship, store, and deliver container content49CVE-2026-33540High· 7.5Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm41CVE-2026-41888MediumDistribution's tag deletion bypasses `storage.delete.enabled` configuration28
distribution vulnerabilities
CVEs affecting distribution, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-85747Medium· 6.8PoCDistribution is a toolkit to pack, ship, store, and deliver container content
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest witho…
CVE-2026-41888MediumDistribution's tag deletion bypasses `storage.delete.enabled` configuration
Distribution's tag deletion bypasses `storage.delete.enabled` configuration
CVE-2026-33540High· 7.5Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm
Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm
CVE-2026-35172High· 7.5PoCDistribution is a toolkit to pack, ship, store, and deliver container content
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: t…