CVE-2025-24976
1 advisory.
Go/github.com/distribution/distribution CVE-2025-24976: medium 6.6, EPSS 0.35%
Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT in github.com/distribution/distribution
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: GO-2025-3460
- nvd: CVE-2025-24976
- https://github.com/distribution/distribution/security/advisories/GHSA-phw4-mc57-4hwc
- https://github.com/distribution/distribution/commit/5ea9aa028db65ca5665f6af2c20ecf9dc34e5fcd
CVE-2025-24976 · published · modified · JSON