{"id":"GO-2026-6778","revision":"50aa780fb94042d8b08ab755063141ac","records":[{"revision":"50aa780fb94042d8b08ab755063141ac","observedAt":"2026-11-05T23:38:32.248+00:00","statement":{"source":"osv","id":"GO-2026-6778","aliases":["BIT-distribution-2026-85747","CVE-2026-85747","GHSA-685w-q87j-wqw3"],"title":"Distribution: Client does not verify returned content against requested digest in github.com/distribution/distribution","description":"Distribution: Client does not verify returned content against requested digest in github.com/distribution/distribution","state":0,"publishedAt":"2026-11-05T22:54:00+00:00","modifiedAt":"2026-11-05T23:25:40.3913774+00:00","affected":[{"ecosystem":"Go","name":"github.com/distribution/distribution","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/distribution/distribution/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.1.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/docker/distribution","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/distribution/distribution/security/advisories/GHSA-685w-q87j-wqw3","https://github.com/distribution/distribution/commit/8f91c26c8888a95a36c2357a6e30bc15d4dd76d3","https://github.com/distribution/distribution/commit/960439b09f342cdeb8f1c0e18e8c7349bdcfbf80","https://github.com/distribution/distribution/releases/tag/v3.1.2"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6778","license":"OSV · upstream source license applies","key":"osv:GO-2026-6778","identifiers":["GO-2026-6778","BIT-distribution-2026-85747","CVE-2026-85747","GHSA-685w-q87j-wqw3"]},"retained":false,"historicalAffected":[]}],"coverage":[]}