---
id: CVE-2021-41190
aliases:
  - GHSA-mc8v-mgrf-8f4m
title: Clarify Content-Type handling
summary: Clarify Content-Type handling
severity: low
cvss: 3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N'
vendor: opencontainers
product: github.com/opencontainers/distribution-spec
ecosystem: go
affected:
  - github.com/opencontainers/distribution-spec < 1.0.1
patched:
  - github.com/opencontainers/distribution-spec 1.0.1
published: '2021-11-18'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-mc8v-mgrf-8f4m'
references:
  - url: >-
      https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-41190'
  - url: >-
      https://github.com/opencontainers/distribution-spec/commit/ac28cac0557bcd3084714ab09f9f2356fe504923
  - url: 'https://github.com/opencontainers/distribution-spec'
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3TUZNDAH2B26VPBK342UC3BHZNLBUXGX
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4334HT7AZPLWNYHW4ARU6JBUF3VZJPZN
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A2RRFNTMFYKOTRKD37F5ANMCIO3GGJML
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DX63GRWFEI5RVMYV6XLMCG4OHPWZML27
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RZTO6N55WHKHIZI4IMLY2QFBPMVTAERM
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SQBCYJUIM5GVCMFUPRWKRZNXMMI5EFA4
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T4OJ764CKKCWCVONHD4YXTGR7HZ7LRUV
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YIGVQWOA5XXCQXEOOKZX4CDAGLBDRPRX
  - url: 'http://www.openwall.com/lists/oss-security/2021/11/19/10'
tags:
  - osv
  - go
epss: 0.02241
epssPercentile: 0.821
ingestedAt: '2026-07-09T18:56:36.627Z'
---

## Overview

### Impact
In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently.

### Patches
The OCI Distribution Specification will be updated to require that a `mediaType` value present in a manifest or index match the Content-Type header used during the push and pull operations.

### Workarounds
Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields.

### References
https://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-xpmg-72qh

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/opencontainers/distribution-spec/
* Email us at security@opencontainers.org


## Affected packages

- `github.com/opencontainers/distribution-spec < 1.0.1`

## Remediation

Upgrade to a patched release:

- `github.com/opencontainers/distribution-spec 1.0.1`