CVE-2017-11468

What it actually does

The registry fails to enforce size limits on user-supplied content at the manifest endpoint, allowing unbounded memory allocation that exhausts available RAM and produces a denial of service.

Why it matters to the business

Registry services become unavailable, halting image pushes, pulls, and deployments across dependent build and runtime systems until the process is restarted or memory pressure subsides.

How an attack unfolds

An unauthenticated remote attacker repeatedly posts oversized manifest payloads to the registry's manifest endpoint; each request triggers allocation of memory proportional to the payload size until the service is starved or crashes.

How to fix it

Upgrade distribution/distribution to commit 48294d928ced5dd9b378f7fd7c6f5da3ff3f2c89 or later; upgrade tekton-chains (Chainguard or Wolfi) to 0.20.1-r4 or later. Enforce network-level rate limiting or request-size caps in front-end proxies until patches are applied.

How to confirm the fix worked

Confirm the running binary or image reports a fixed version or commit; replay a manifest larger than the historical default limit and verify the request is rejected with an appropriate error rather than consuming memory.

Typical attack path

1. Identify an exposed Docker Registry instance
2. Craft HTTP POST requests containing arbitrarily large manifest bodies
3. Send requests to the /v2/<name>/manifests/<reference> endpoint without authentication
4. Repeat until memory consumption triggers service degradation or restart

How to detect it

Inspect HTTP access logs for POST requests to manifest endpoints that carry unusually large Content-Length values; correlate with sudden spikes in resident memory or out-of-memory events in registry process telemetry.

What your security team should do

• Apply the listed fixed versions immediately on all registry deployments
• Place the registry behind a reverse proxy that enforces request body size limits
• Monitor memory usage and restart policies for registry containers
• Review and restrict network exposure of the manifest endpoint