{"schemaVersion":3,"id":"CVE-2025-24976","aliases":["CGA-23pc-9j8r-hh39","CGA-3x4q-8f3f-4464","CGA-6ppp-86gj-phg9","CGA-722c-mhvg-pj6p","CGA-78x8-46hq-ff9p","CGA-7pq7-pwc5-4x79","CGA-93pr-mxfq-4hcj","CGA-fcrx-6jpp-6rvg","CGA-jx6v-46m2-xmhr","CGA-m3x9-wc86-3pfg","CGA-m4j5-5pfp-95cw","CGA-qg33-8fpj-7qvf","CGA-qqf6-m248-32h3","CGA-r737-mvcg-g45j","CGA-r8rp-7g8q-8m3v","CGA-wjp2-cjmf-65rf","GO-2025-3460","GHSA-phw4-mc57-4hwc","CGA-249h-5w82-g6f7","CGA-2cc5-m6gv-fv94","CGA-2f3h-xwfc-78f6","CGA-2jhv-qx6p-688q","CGA-3579-h84h-pp9w","CGA-37cr-p89x-p4h6","CGA-3v3v-v8vr-724m","CGA-3xg8-3p83-x854","CGA-42j5-2458-xp6g","CGA-46r5-273v-g8hj","CGA-4g33-2753-gv8q","CGA-5532-5mqj-mvr2","CGA-5ch8-xq4c-wjfp","CGA-5jcc-mc66-qv99","CGA-6r83-9p8x-r8h5","CGA-896r-w4mf-c4r6","CGA-8g9m-8j43-7w45","CGA-8hmw-q4hp-hq33","CGA-924g-w7rm-9fg4","CGA-9w83-fj6f-r5mf","CGA-ccg4-mgq7-6hxw","CGA-cg2p-m7px-557p","CGA-ch73-9f2j-8q75","CGA-cjgg-cvh6-8m2p","CGA-cmqg-j9x2-6v5m","CGA-cwh2-469f-r825","CGA-f637-4vx9-w4rw","CGA-f8hp-55wr-3558","CGA-f9p9-m5qq-3q94","CGA-fm24-7p6w-q7g6","CGA-fr75-8vcw-37f3","CGA-gwph-4q5h-4m4w","CGA-gxgw-5gf5-85jf","CGA-h6cg-h7wg-cpjg","CGA-hrjf-2rv9-2q88","CGA-jqr3-6h67-mfvp","CGA-m2cx-h5rv-4w8g","CGA-m6qx-6j2h-59pw","CGA-mjc9-fh2q-qv3p","CGA-mm34-hf5r-c2cr","CGA-p4wg-jxjr-rc8g","CGA-p8xq-mxrc-6gq8","CGA-ppc7-cm79-6c5x","CGA-pxhq-2v84-pq4r","CGA-q28g-jxc5-74pp","CGA-qpcv-76gq-jc3c","CGA-qv8h-52x6-rw57","CGA-r5xr-54xp-pj37","CGA-vvhm-j8w4-jw7x","CGA-wq9m-v82m-mjjm","CGA-wqmr-rpxw-8cmw","CGA-wx9p-8p67-pc6g","CGA-xcvc-xr32-9hf7","CGA-xffh-8hq6-pgf2","CGA-xjmj-7mmv-qj88","CGA-xwmj-5w44-ggm7"],"status":"published","duplicateOf":null,"title":null,"description":"Distribution is a toolkit to pack, ship, store, and deliver container content. Systems running registry versions 3.0.0-beta.1 through 3.0.0-rc.2 with token authentication enabled may be vulnerable to an issue in which token authentication allows an attacker to inject an untrusted signing key in a JSON web token (JWT). The issue lies in how the JSON web key (JWK) verification is performed. When a JWT contains a JWK header without a certificate chain, the code only checks if the KeyID (`kid`) matches one of the trusted keys, but doesn't verify that the actual key material matches. A fix for the issue is available at commit 5ea9aa028db65ca5665f6af2c20ecf9dc34e5fcd and expected to be a part of version 3.0.0-rc.3. There is no way to work around this issue without patching if the system requires token authentication.","dates":{"published":"2025-02-11T15:48:59.700Z","modified":"2026-01-23T17:04:22.154Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.6,"severity":"medium","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":6.6,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Wolfi","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Chainguard","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":6.6,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00353,"percentile":0.27561,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00353},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00353,"percentile":0.27561}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00353,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00353,"percentile":0.27561}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-639","name":"Authorization Bypass Through User-Controlled Key","description":"The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/639.html"}],"affected":[{"vendor":"chainguard","product":"harbor-2.12","name":"harbor-2.12","label":"harbor-2.12","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-2.12","purlType":"apk","versions":[{"text":"< 2.12.4-r43","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12.4-r43","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-2.12-exporter","name":"harbor-2.12-exporter","label":"harbor-2.12-exporter","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-2.12-exporter","purlType":"apk","versions":[{"text":"< 2.12.4-r43","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12.4-r43","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-2.12-jobservice","name":"harbor-2.12-jobservice","label":"harbor-2.12-jobservice","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-2.12-jobservice","purlType":"apk","versions":[{"text":"< 2.12.4-r43","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12.4-r43","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-2.12-registryctl","name":"harbor-2.12-registryctl","label":"harbor-2.12-registryctl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-2.12-registryctl","purlType":"apk","versions":[{"text":"< 2.12.4-r43","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12.4-r43","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-2.13","name":"harbor-2.13","label":"harbor-2.13","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-2.13","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-2.13-exporter","name":"harbor-2.13-exporter","label":"harbor-2.13-exporter","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-2.13-exporter","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-2.13-jobservice","name":"harbor-2.13-jobservice","label":"harbor-2.13-jobservice","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-2.13-jobservice","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-2.13-registryctl","name":"harbor-2.13-registryctl","label":"harbor-2.13-registryctl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-2.13-registryctl","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-2.14","name":"harbor-2.14","label":"harbor-2.14","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-2.14","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-2.14-exporter","name":"harbor-2.14-exporter","label":"harbor-2.14-exporter","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-2.14-exporter","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-2.14-jobservice","name":"harbor-2.14-jobservice","label":"harbor-2.14-jobservice","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-2.14-jobservice","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-2.14-registryctl","name":"harbor-2.14-registryctl","label":"harbor-2.14-registryctl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-2.14-registryctl","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-2.15","name":"harbor-2.15","label":"harbor-2.15","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-2.15","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-2.15-exporter","name":"harbor-2.15-exporter","label":"harbor-2.15-exporter","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-2.15-exporter","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-2.15-jobservice","name":"harbor-2.15-jobservice","label":"harbor-2.15-jobservice","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-2.15-jobservice","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-2.15-registryctl","name":"harbor-2.15-registryctl","label":"harbor-2.15-registryctl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-2.15-registryctl","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-fips-2.12","name":"harbor-fips-2.12","label":"harbor-fips-2.12","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-fips-2.12","purlType":"apk","versions":[{"text":"< 2.12.4-r41","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12.4-r41","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-fips-2.12-exporter","name":"harbor-fips-2.12-exporter","label":"harbor-fips-2.12-exporter","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-fips-2.12-exporter","purlType":"apk","versions":[{"text":"< 2.12.4-r41","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12.4-r41","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-fips-2.12-jobservice","name":"harbor-fips-2.12-jobservice","label":"harbor-fips-2.12-jobservice","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-fips-2.12-jobservice","purlType":"apk","versions":[{"text":"< 2.12.4-r41","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12.4-r41","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-fips-2.12-registryctl","name":"harbor-fips-2.12-registryctl","label":"harbor-fips-2.12-registryctl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-fips-2.12-registryctl","purlType":"apk","versions":[{"text":"< 2.12.4-r41","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12.4-r41","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-fips-2.13","name":"harbor-fips-2.13","label":"harbor-fips-2.13","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-fips-2.13","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-fips-2.13-exporter","name":"harbor-fips-2.13-exporter","label":"harbor-fips-2.13-exporter","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-fips-2.13-exporter","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-fips-2.13-jobservice","name":"harbor-fips-2.13-jobservice","label":"harbor-fips-2.13-jobservice","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-fips-2.13-jobservice","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-fips-2.13-registryctl","name":"harbor-fips-2.13-registryctl","label":"harbor-fips-2.13-registryctl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-fips-2.13-registryctl","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-fips-2.14","name":"harbor-fips-2.14","label":"harbor-fips-2.14","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-fips-2.14","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-fips-2.14-exporter","name":"harbor-fips-2.14-exporter","label":"harbor-fips-2.14-exporter","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-fips-2.14-exporter","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-fips-2.14-jobservice","name":"harbor-fips-2.14-jobservice","label":"harbor-fips-2.14-jobservice","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-fips-2.14-jobservice","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-fips-2.14-registryctl","name":"harbor-fips-2.14-registryctl","label":"harbor-fips-2.14-registryctl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-fips-2.14-registryctl","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-fips-2.15","name":"harbor-fips-2.15","label":"harbor-fips-2.15","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-fips-2.15","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-fips-2.15-exporter","name":"harbor-fips-2.15-exporter","label":"harbor-fips-2.15-exporter","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-fips-2.15-exporter","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-fips-2.15-jobservice","name":"harbor-fips-2.15-jobservice","label":"harbor-fips-2.15-jobservice","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-fips-2.15-jobservice","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"harbor-fips-2.15-registryctl","name":"harbor-fips-2.15-registryctl","label":"harbor-fips-2.15-registryctl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/harbor-fips-2.15-registryctl","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kots","name":"kots","label":"kots","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kots","purlType":"apk","versions":[{"text":"< 1.124.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.124.3-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kots-compat","name":"kots-compat","label":"kots-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kots-compat","purlType":"apk","versions":[{"text":"< 1.124.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.124.3-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kots-symlink-compat","name":"kots-symlink-compat","label":"kots-symlink-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kots-symlink-compat","purlType":"apk","versions":[{"text":"< 1.124.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.124.3-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zot","name":"zot","label":"zot","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zot","purlType":"apk","versions":[{"text":"< 2.1.2-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.1.2-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"harbor-2.14","name":"harbor-2.14","label":"harbor-2.14","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/harbor-2.14","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"harbor-2.14-exporter","name":"harbor-2.14-exporter","label":"harbor-2.14-exporter","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/harbor-2.14-exporter","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"harbor-2.14-jobservice","name":"harbor-2.14-jobservice","label":"harbor-2.14-jobservice","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/harbor-2.14-jobservice","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"harbor-2.14-registryctl","name":"harbor-2.14-registryctl","label":"harbor-2.14-registryctl","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/harbor-2.14-registryctl","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kots","name":"kots","label":"kots","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kots","purlType":"apk","versions":[{"text":"< 1.124.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.124.3-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kots-compat","name":"kots-compat","label":"kots-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kots-compat","purlType":"apk","versions":[{"text":"< 1.124.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.124.3-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kots-symlink-compat","name":"kots-symlink-compat","label":"kots-symlink-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kots-symlink-compat","purlType":"apk","versions":[{"text":"< 1.124.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.124.3-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"zot","name":"zot","label":"zot","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/zot","purlType":"apk","versions":[{"text":"< 2.1.2-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.1.2-r2","eol":null,"hubHref":null},{"vendor":"distribution","product":"distribution","name":"distribution","label":"distribution","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 3.0.0-beta.1, ≤ 3.0.0-rc.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 3.0.0-beta.1, ≤ 3.0.0-rc.2","eol":null,"hubHref":"/vendor/distribution/distribution"},{"vendor":"github.com/distribution","product":"distribution","name":"github.com/distribution/distribution","label":"distribution","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/distribution/distribution","purlType":"golang","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null}],"affectedCount":46,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/distribution/distribution/security/advisories/GHSA-phw4-mc57-4hwc","label":"github.com/distribution/distribution/security/advisories/GHSA-phw4-mc57-4hwc","hostname":"github.com","tags":["X Refsource CONFIRM","Advisory"]},{"url":"https://github.com/distribution/distribution/commit/f4a500caf68169dccb0b54cb90523e68ee1ac2be","label":"github.com/distribution/distribution/commit/f4a500caf68169dccb0b54cb90523e68ee1ac2be","hostname":"github.com","tags":["X Refsource MISC","FIX"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24976.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24976.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24976","label":"nvd.nist.gov/vuln/detail/CVE-2025-24976","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/distribution/distribution/commit/5ea9aa028db65ca5665f6af2c20ecf9dc34e5fcd","label":"github.com/distribution/distribution/commit/5ea9aa028db65ca5665f6af2c20ecf9dc34e5fcd","hostname":"github.com","tags":["FIX"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2025:14889-1"],"duplicates":[],"related":["CGA-92RH-G2JC-P3WF","CGA-96M3-MR7P-MX3F","OPENSUSE-SU-2025:14889-1"]},"timeline":[{"kind":"published","date":"2025-02-11T15:48:59.700Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-01-23T17:04:22.154Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":26,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T22:18:18.653Z","stale":false,"partial":false}}