{"id":"ghsa-ghsa-685w-q87j-wqw3","seq":2467,"kind":"advisory","title":"Distribution: Client `manifests.Get()` does not verify returned content against requested digest","url":"https://github.com/advisories/GHSA-685w-q87j-wqw3","permalink":"https://vulnpulse.app/items/ghsa-ghsa-685w-q87j-wqw3","summary":"影響: go:github.com/docker/distribution <= 2.8.3, go:github.com/distribution/distribution/v3 < 3.1.2 → 3.1.2\nSummary registry/client.(manifests).Get(ctx, dgst, …) fetches a manifest by digest but never hashes the returned body and compares it against the requested digest. A malicious or compromised registry, or any MITM on the registry connection, can serve arbitrary manifest bytes in response to a digest-pinned request and the client returns the substituted content transparently to the caller. Any application relying on digest pinning for supply-chain integrity — image policy controllers, mirrors, pu…","severity":"medium","techs":["go","github","docker"],"cves":["CVE-2026-85747"],"tags":["GHSA-685w-q87j-wqw3","github.com/docker/distribution","github.com/distribution/distribution/v3"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-15T20:22:02.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}