CVE-2023-2253: distribution catalog API endpoint can lead to OOM via malicious user input

May 11, 2023

Impact

Systems that run distribution built after a specific commit running on memory-restricted environments can suffer from denial of service by a crafted malicious /v2/_catalog API endpoint request.

References

github.com/advisories/GHSA-hqxw-f8mx-cpmw
github.com/distribution/distribution/commit/f55a6552b006a381d9167e328808565dd2bf77dc
github.com/distribution/distribution/security/advisories/GHSA-hqxw-f8mx-cpmw

Detect and mitigate CVE-2023-2253 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →