Resource allocation without limits in distribution/distribution
Priority LOW 31CWE-475Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 4 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.
Summary
A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (query string: `n`). This vulnerability allows a malicious user to submit an unreasonably large value for `n,` causing the allocation of a massive string array, possibly causing a denial of service through excessive use of memory.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00938 61st percentileScored 2026-11-07
Fix Partial github.com/docker/distribution (Go): 2.8.2-beta.1Red Hat: 4 advisoriesRed Hat: 4 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | distribution/distribution | NA | — | No fix listed | CNA |
| — | github.com/docker/distribution (Go) | before 2.8.2-beta.1 | 2.8.2-beta.1 | Patch available | GHSA-hqxw-f8mx-cpmw |
- distribution/distribution Vendor— Affected NA Fixed in — No fix listed CNA
- github.com/docker/distribution (Go) Vendor— Affected before 2.8.2-beta.1 Fixed in 2.8.2-beta.1 Patch available GHSA-hqxw-f8mx-cpmw
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:openshift_api_for_data_protection:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_developer_tools_and_services:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
- cpe:2.3:a:redhat:openshift_api_for_data_protection:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_developer_tools_and_services:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
Remediation
- Fix · GHSA-hqxw-f8mx-cpmw github.com/docker/distribution (Go) Fixed in 2.8.2-beta.1 Advisory →
Red Hat 4 advisories
- RHSA-2023:5697 Released 2023-10-18 · Red Hat rating ImportantOpenShift Container Platform 4.11.52 bug fix and security update
- Red Hat OpenShift Container Platform 4.11 openshift4/ose-docker-registry, openshift4/ose-hyperkube, openshift4/ose-pod
- RHSA-2023:5390 Released 2023-10-04 · Red Hat rating ModerateOpenShift Container Platform 4.12.36 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 openshift4/ose-docker-registry
- RHSA-2023:5314 Released 2023-09-20 · Red Hat rating ModerateOpenShift API for Data Protection (OADP) 1.1.6 security and bug fix update
- 8Base-OADP-1.1 oadp/oadp-kubevirt-velero-plugin-rhel8, oadp/oadp-velero-plugin-for-aws-rhel8, oadp/oadp-velero-plugin-for-csi-rhel8 +5
Show 1 more Red Hat advisories
- RHSA-2023:5155 Released 2023-09-19 · Red Hat rating Moderate[impact]: OpenShift Container Platform 4.13.13 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 openshift4/ose-docker-registry
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Developer Tools and Services | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| 8Base-OADP-1.1 | Fixed | RHSA-2023:5314 |
| Red Hat OpenShift Container Platform 4.11 | Fixed | RHSA-2023:5697 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2023:5390 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2023:5155 |
Not affected: 4 products
- 8Base-OADP-1.1
- Red Hat OpenShift Container Platform 4.11
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.13
Timeline
- 2026-10-02 Threatist record created from CVE-2023-2253
- 2026-10-03 Alias added: GHSA-hqxw-f8mx-cpmw
References
Advisory 2
Other 4
- [debian-lts-announce] 20230629 [SECURITY] [DLA 3473-1] docker-registry security update
- https://github.com/distribution/distribution/security/advisories/GHSA-hqxw-f8mx-cpmw
- https://github.com/distribution/distribution/commit/f55a6552b006a381d9167e328808565dd2bf77dc
- https://github.com/distribution/distribution
More Red Hat Openshift Api For Data Protection vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
Sources
- CVE-2023-2253 · CVE Program
- CVE-2023-2253 · NVD
- FIRST EPSS
- GHSA-hqxw-f8mx-cpmw · GitHub Advisory Database · CC BY 4.0
- CVE-2023-2253 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences