Package
kubevirt-cdi-uploadserver-1.5
Component
github.com/docker/distribution
Latest update
6.8
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
CVE-2026-85747 affects registry/client.(*manifests).Get and the registry/proxy package in github.com/docker/distribution (<= 2.8.3), which has no patched release on this module path; the fix is published only in github.com/distribution/distribution/v3 3.1.2. The shipped binary lists github.com/docker/distribution v2.8.3 in its build information, but the registry/client and registry/proxy packages are not compiled in: only registry/api/errcode, registry/api/v2 and registry/client/auth/challenge are linked, and the container image library provides its own registry client. The vulnerable manifest fetch path is not present in the shipped binary.
Status