CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCVE-2023-2253
Medium (6.5) in redhat. EPSS 0.9% chance of exploitation in the next 30 days. Fixed in github.com/docker/distribution 2.8.2-beta.1.
A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (query string: `n`). This vulnerability allows a malicious user to submit an unreasonably large value for `n,` causing the allocation of a massive string array, possibly causing a denial of service through excessive use of memory.
Severity
- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-770, CWE-475
- Published
- Modified
- Record from
- the NVD, synced
Affected
- redhat:openshift_api_for_data_protection
- redhat:openshift_container_platform
- redhat:openshift_developer_tools_and_services
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hqxw-f8mx-cpmw | Go | github.com/docker/distribution | <2.8.2-beta.1 | 2.8.2-beta.1 |
| GO-2023-1772 | Go | github.com/distribution/distribution | <2.8.2-beta.1+incompatible | 2.8.2-beta.1+incompatible |