GCVE - cpe:2.3:a:distribution_project:distribution:*:*:*:*:*:go:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:distribution_project:distribution:*:*:*:*:*:go:*:*

part: a version: * update: *

Vendor	Distribution Project (`df30b3d5-ab89-5cc0-800a-dfffe878883d`)
Product	Distribution (`ad907b52-614b-5f54-8aff-c884092a5fc3`)
Edition	*
Language	*
Software edition	*
Target software	go
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-33540`	vulnerable	2026-06-08 07:59:10.351682	Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm HIGH (7.5) Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, in pull-through cache mode, distribution discovers token auth endpoints by parsing WWW-Authenticate challenges returned by the configured upstream registry. The realm URL from a bearer challenge is used without validating that it matches the upstream registry host. As a result, an attacker-controlled upstream (or an attacker with MitM position to the upstream) can cause distribution to send the configured upstream credentials via basic auth to an attacker-controlled realm URL. This vulnerability is fixed in 3.1.0. Published: 2026-04-06T14:55:04.812Z Updated: 2026-04-06T15:04:50.154Z Open on db.gcve.eu Reference links https://github.com/distribution/distribution/security/advisories/GHSA-3p65-76g6-3w7r	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.