Distribution: Client `manifests.Get()` does not verify returned content against requested digest

影響: go:github.com/docker/distribution <= 2.8.3, go:github.com/distribution/distribution/v3 < 3.1.2 → 3.1.2

registry/client.(manifests).Get(ctx, dgst, …) fetches a manifest by digest but never hashes the returned body and compares it against the requested digest. A malicious or compromised registry, or any MITM on the registry connection, can serve arbitrary manifest bytes in response to a digest-pinned request and the client returns the substituted content transparently to the caller. Any application relying on digest pinning for supply-chain integrity — image policy controllers, mirrors, pu…

在 GitHub Advisory Database 阅读

2026/10/16 05:22，GitHub Advisory Database 发布了“Distribution: Client `manifests.Get()` does not verify returned content against requested digest”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：Go、GitHub、Docker。CVE：CVE-2026-85747。