Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-2253

Date: June 5, 2023

A flaw was found in the "/v2/_catalog" endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (query string: "n"). This vulnerability allows a malicious user to submit an unreasonably large value for "n," causing the allocation of a massive string array, possibly causing a denial of service through excessive use of memory.

Language: Go

Severity Score

Related Resources (8)

https://bugzilla.redhat.com/show_bug.cgi?id=2189886
https://github.com/distribution/distribution/commit/f55a6552b006a381d9167e328808565dd2bf77dc
https://github.com/advisories/GHSA-hqxw-f8mx-cpmw
https://github.com/distribution/distribution
https://nvd.nist.gov/vuln/detail/CVE-2023-2253
https://lists.debian.org/debian-lts-announce/2023/06/msg00035.html
https://github.com/distribution/distribution/security/advisories/GHSA-hqxw-f8mx-cpmw
https://www.mend.io/vulnerability-database/CVE-2023-2253

Severity Score

Weakness Type (CWE)

Undefined Behavior for Input to API

CWE-475

Allocation of Resources Without Limits or Throttling

CWE-770

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): HIGH

Do you need more information?

Contact Us