CVE-2023-2253: distribution catalog API endpoint can lead to OOM via malicious user input

May 11, 2023

Impact

Systems that run distribution built after a specific commit running on memory-restricted environments can suffer from denial of service by a crafted malicious /v2/_catalog API endpoint request.

References

github.com/advisories/GHSA-hqxw-f8mx-cpmw
github.com/distribution/distribution/commit/f55a6552b006a381d9167e328808565dd2bf77dc
github.com/distribution/distribution/security/advisories/GHSA-hqxw-f8mx-cpmw

Code Behaviors & Features

Detect and mitigate CVE-2023-2253 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →