Executive brief
Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT in github.com/distribution/distribution
Affected products
- Go github.com/distribution/distribution
Junglewise Threat Intelligence
CVE-2025-24976: GO-2025-3460 - Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT in github.com/distribution/distribution
CVE-2025-24976 · Severity: info · Published 2025-03-03
Technologies: github.com/distribution/distribution (Go). Vendors: Go.
Related threats
- GO-2026-5094 - Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm in github.com/distribution/distributio
- Distribution tag deletion bypasses storage delete configuration
- Distribution stale blob access resurrection in Redis cache backend
- GO-2023-1772 - Memory exhaustion in github.com/distribution/distribution