CVE-2025-24882

Published: Jan 29, 2025Modified: Jun 17, 2026Deferred

5.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N

Exploitability: 0.9 / Impact: 4.2

Source: security-advisories@github.com (Secondary)

Description

regclient is a Docker and OCI Registry Client in Go. A malicious registry could return a different digest for a pinned manifest without detection. This vulnerability is fixed in 0.7.1.

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-345

Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References (2)

https://github.com/regclient/regclient/commit/7d17cff26c22196b5ddd66bda8c5ee4abf3d1269

Source: security-advisories@github.com

https://github.com/regclient/regclient/security/advisories/GHSA-qv35-3gw6-8q4j

Source: security-advisories@github.com

Timeline

No history available yet.