StackRadar

CVE-2023-2253

High

Advisory

Published 11 May 2023In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.009
59th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
310
of 17,781 indexed, latest versions
Container images
284
deployed by those charts
Fix available
2 of 2
affected packages

distribution catalog API endpoint can lead to OOM via malicious user input

Carried by container images the latest versions of 310 of 17,781 indexed charts deploy, on 284 images.

Affected packageAffected versionsFixed inImages
github.com/docker/distributiongolangv0.0.0-20171011171712-7484e51bf6af, v0.0.0-20191216044856-a8371794149d, v0.0.0-20260602055908-11540eae06cb+dirty, v0.0.0-20260701071724-493dca9a81a8+dirty+7 more2.8.2-beta.1280
github.com/distribution/distributiongolangv2.7.1+incompatible, v2.8.0+incompatible, v2.8.1+incompatible2.8.2-beta.1+incompatible8
OSV records
GHSA-hqxw-f8mx-cpmwGO-2023-1772

Charts affected

310 by stars
ChartLatestAffected imagesRadar Score
verzoekregistratiecomponentverzoekregistratiecomponent1.1.01 of 4See more

verzoekregistratiecomponent verzoekregistratiecomponent 1.1.0

1 of the 4 container images this version deploys carry CVE-2023-2253.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/verzoekregistratiecomponent-php:latestc4f6c03af5d3
github.com/docker/distribution@v0.0.0-20191216044856-a8371794149d
2.8.2-beta.1

Open the chart page →

7,429
verzoektypecatalogusverzoektypecatalogus1.1.01 of 4See more

verzoektypecatalogus verzoektypecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2023-2253.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/verzoektypecatalogus-php:latest64f5eb7a398b
github.com/docker/distribution@v0.0.0-20191216044856-a8371794149d
2.8.2-beta.1

Open the chart page →

7,429
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2023-2253.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.14.45a065930682d
github.com/docker/distribution@v2.7.1+incompatible
2.8.2-beta.1

Open the chart page →

5,484
wazuh-manager-filebeatwazuh-manager-filebeat0.1.0-gamma1 of 1See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2023-2253.

Container imageDigestPackageFixed in
iosifache/wazuh-manager-filebeat:latest85df3f04b5da
github.com/docker/distribution@v2.7.1+incompatible
2.8.2-beta.1

Open the chart page →

11,119
istio-service-meshwbstack0.0.11 of 1See more

istio-service-mesh wbstack 0.0.1

1 of the 1 container images this version deploys carry CVE-2023-2253.

Container imageDigestPackageFixed in
istio/pilot:1.17.1ce9d87606701
github.com/docker/distribution@v2.8.1+incompatible
2.8.2-beta.1

Open the chart page →

6,232
webresourcecataloguswebresourcecatalogus1.1.01 of 4See more

webresourcecatalogus webresourcecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2023-2253.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/webresourcecatalogus-php:latest8f1bbd5cda85
github.com/docker/distribution@v0.0.0-20191216044856-a8371794149d
2.8.2-beta.1

Open the chart page →

7,552
harborwenerme1.19.22 of 8See more

harbor wenerme 1.19.2

2 of the 8 container images this version deploys carry CVE-2023-2253.

Container imageDigestPackageFixed in
goharbor/harbor-registryctl:v2.15.2223d5cb49d5d
github.com/docker/distribution@v0.0.0-20260701071724-493dca9a81a8+dirty
2.8.2-beta.1
goharbor/registry-photon:v2.15.2c4ebef61ceb5
github.com/docker/distribution@v0.0.0-20260701071724-493dca9a81a8+dirty
2.8.2-beta.1

Open the chart page →

1,650
longhornwenerme1.2.31 of 2See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2023-2253.

Container imageDigestPackageFixed in
longhornio/longhorn-manager:v1.2.3dca34321452c
github.com/docker/distribution@v2.7.1+incompatible
2.8.2-beta.1

Open the chart page →

15,230
traefikwenerme9.1.11 of 1See more

traefik wenerme 9.1.1

1 of the 1 container images this version deploys carry CVE-2023-2253.

Container imageDigestPackageFixed in
library/traefik:2.2.8f5af5a5ce17f
github.com/docker/distribution@v2.7.1+incompatible
2.8.2-beta.1

Open the chart page →

3,369
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2023-2253.

Container imageDigestPackageFixed in
murtazashah46/helmfile:latest4d11726cf803
github.com/docker/distribution@v2.8.1+incompatible
2.8.2-beta.1

Open the chart page →

13,677

Container images carrying it

284 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
opencord/onos-classic-helm-utils:0.1.00d693ba85fd6
github.com/docker/distribution@v0.0.0-20191216044856-a8371794149d
2.8.2-beta.1
1
otel/opentelemetry-collector:0.59.0ee9da0b08d83
github.com/docker/distribution@v2.8.1+incompatible
2.8.2-beta.1
1
otel/opentelemetry-collector-contrib:0.46.0ba173aa85f3f
github.com/docker/distribution@v2.8.0+incompatible
2.8.2-beta.1
1
otel/opentelemetry-collector-contrib:0.63.1dfb3a55ea8c9
github.com/docker/distribution@v2.8.1+incompatible
2.8.2-beta.1
1
phntom/chartmuseum:v0.15.29242b4df9e65
github.com/docker/distribution@v2.8.1+incompatible
2.8.2-beta.1
1
phntom/external-dns-host-network:0.0.123adadbac8443
github.com/docker/distribution@v2.8.1+incompatible
2.8.2-beta.1
1
pnnlmiscscripts/gitlab-runner-operator:0.1.3-1155131891741
github.com/docker/distribution@v2.7.1+incompatible
2.8.2-beta.1
1
portainer/portainer-ce:2.18.4-alpine3e61aaee1341
github.com/docker/distribution@v2.8.1+incompatible
2.8.2-beta.1
1
prom/prometheus:v2.22.2f7ffebdd428b
github.com/docker/distribution@v2.7.1+incompatible
2.8.2-beta.1
1
rancher/hardened-flannel:v0.13.0-rancher142784bb38ed3
github.com/docker/distribution@v2.4.0+incompatible
2.8.2-beta.1
1
rancher/k3s:v1.25.3-k3s1eaa270df79cc
github.com/docker/distribution@v2.8.1+incompatible
2.8.2-beta.1
1
rancher/kubectl:v1.25.085a0d1148784
github.com/docker/distribution@v2.8.1+incompatible
2.8.2-beta.1
1
sealio/terraform-deployer:v1.5.7-seal.1b0389d9848a5
github.com/docker/distribution@v2.8.1+incompatible
2.8.2-beta.1
1
sikalabs/slu:v0.34.0fdc0c6711add
github.com/docker/distribution@v0.0.0-20171011171712-7484e51bf6af
2.8.2-beta.1
1
simpleidserver/faasprometheus:0.0.425e378d57d78
github.com/docker/distribution@v2.7.1+incompatible
2.8.2-beta.1
1
slamdev/flux-notifier:v0.0.8b173d809132d
github.com/docker/distribution@v2.7.1+incompatible
2.8.2-beta.1
1
someblackmagic/k8s-testing-multitool:v0.1.06eca64b6b440
github.com/docker/distribution@v2.7.1+incompatible
2.8.2-beta.1
1
sstarcher/helm-exporter:0.5.011769d01ba35
github.com/docker/distribution@v2.7.1+incompatible
2.8.2-beta.1
1
thanosio/thanos:v0.15.0b12d5c31bf5a
github.com/docker/distribution@v2.7.1+incompatible
2.8.2-beta.1
1
thmmniii/fbs-runner:v1.27.186105349c1a3
github.com/docker/distribution@v2.8.1+incompatible
2.8.2-beta.1
1
toucansoftware/spa-reloader:latestc187b1fba501
github.com/docker/distribution@v2.7.1+incompatible
2.8.2-beta.1
1
wazuh/wazuh-manager:4.11.11da5c38c6a78
github.com/docker/distribution@v2.7.1+incompatible
2.8.2-beta.1
1
wazuh/wazuh-manager:4.4.121994f40e0da
github.com/docker/distribution@v2.7.1+incompatible
2.8.2-beta.1
1
wazuh/wazuh-manager:4.14.45a065930682d
github.com/docker/distribution@v2.7.1+incompatible
2.8.2-beta.1
1
wazuh/wazuh-manager:4.14.3f09282d281f6
github.com/docker/distribution@v2.7.1+incompatible
2.8.2-beta.1
1
gcr.io/cadvisor/cadvisor:v0.40.0135327c978de
github.com/docker/distribution@v2.7.1+incompatible
2.8.2-beta.1
1
gcr.io/cadvisor/cadvisor:v0.47.2e6c562b5e983
github.com/docker/distribution@v2.8.1+incompatible
2.8.2-beta.1
1
gcr.io/gloo-mesh/gloo-mesh:1.1.2a4011eae6a0b
github.com/docker/distribution@v0.0.0-20191216044856-a8371794149d
2.8.2-beta.1
1
gcr.io/knative-releases/knative.dev/serving/cmd/controller:v1.13.153d9aa4d2c7a
github.com/docker/distribution@v2.8.1+incompatible
2.8.2-beta.1
1
gcr.io/knative-releases/knative.dev/serving/cmd/controller:v1.2.575cfdcfa050a
github.com/docker/distribution@v2.8.0+incompatible
2.8.2-beta.1
1
gcr.io/knative-releases/knative.dev/serving/cmd/controller:v1.10.298a2cc7fd62e
github.com/docker/distribution@v2.8.1+incompatible
2.8.2-beta.1
1
gcr.io/kubecost1/server:prod-1.82.22b1a3d08caac
github.com/docker/distribution@v2.7.1+incompatible
2.8.2-beta.1
1
gcr.io/kubecost1/server:prod-1.81.0a348db3e4d74
github.com/docker/distribution@v2.7.1+incompatible
2.8.2-beta.1
1
gcr.io/press-labs-public/dashboard:1.8.19b88f88070fb0
github.com/docker/distribution@v2.7.1+incompatible
2.8.2-beta.1
1
gcr.io/projectsigstore/cosigned784518ff3ee7
github.com/docker/distribution@v2.8.0+incompatible
2.8.2-beta.1
1
gcr.io/projectsigstore/policy-webhook82940e8c3e0d
github.com/docker/distribution@v2.8.0+incompatible
2.8.2-beta.1
1
ghcr.io/chaos-mesh/chaos-daemon:v2.5.1cf78fdf7403a
github.com/docker/distribution@v2.8.1+incompatible
2.8.2-beta.1
1
ghcr.io/chaos-mesh/chaos-dashboard:v2.5.1448cb346b12c
github.com/docker/distribution@v2.8.1+incompatible
2.8.2-beta.1
1
ghcr.io/chaos-mesh/chaos-mesh:v2.5.1700bb42ac21d
github.com/docker/distribution@v2.8.1+incompatible
2.8.2-beta.1
1
ghcr.io/conductionnl/adresservice-php:latestc5075f0320cd
github.com/docker/distribution@v0.0.0-20191216044856-a8371794149d
2.8.2-beta.1
1
ghcr.io/conductionnl/authorization-component-php:latest94a749392fcf
github.com/docker/distribution@v0.0.0-20191216044856-a8371794149d
2.8.2-beta.1
1
ghcr.io/conductionnl/berichtservice-php:latestee6a21e66ff0
github.com/docker/distribution@v0.0.0-20191216044856-a8371794149d
2.8.2-beta.1
1
ghcr.io/conductionnl/brpservice-php:latestc17f1ba17d36
github.com/docker/distribution@v0.0.0-20191216044856-a8371794149d
2.8.2-beta.1
1
ghcr.io/conductionnl/contactcatalogus-php:latesteeb625bd660c
github.com/docker/distribution@v0.0.0-20191216044856-a8371794149d
2.8.2-beta.1
1
ghcr.io/conductionnl/digispoof-interface-php:latest03aba499950f
github.com/docker/distribution@v0.0.0-20191216044856-a8371794149d
2.8.2-beta.1
1
ghcr.io/conductionnl/eav-component-php:latest24bbca4a52a8
github.com/docker/distribution@v0.0.0-20191216044856-a8371794149d
2.8.2-beta.1
1
ghcr.io/conductionnl/education-component-php:latestda6b05a1a601
github.com/docker/distribution@v0.0.0-20191216044856-a8371794149d
2.8.2-beta.1
1
ghcr.io/conductionnl/eherkenning-ui-php:latestdeed102b4255
github.com/docker/distribution@v0.0.0-20191216044856-a8371794149d
2.8.2-beta.1
1
ghcr.io/conductionnl/grafregistratiecomponent-php:latest35225eaa87ab
github.com/docker/distribution@v0.0.0-20191216044856-a8371794149d
2.8.2-beta.1
1
ghcr.io/conductionnl/instemmingservice-php:latest4ffe222b3e3a
github.com/docker/distribution@v0.0.0-20191216044856-a8371794149d
2.8.2-beta.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.