github.com/distribution/distribution/v3 vulnerabilities
CVEs whose affected-version data names the github.com/distribution/distribution/v3 package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-41888MediumDistribution's tag deletion bypasses `storage.delete.enabled` configuration
Distribution's tag deletion bypasses `storage.delete.enabled` configuration
▾ Sunlitdistribution · github.com/distribution/distribution/v3EPSS 0.29%via OSV
CVE-2026-33540High· 7.5Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm
Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm
▾ Twilightdistribution · github.com/distribution/distribution/v3EPSS 0.27%via OSV