VDB
GO-2025-3460
GO-2025-3460
PUBLISHED
Record from OSV · Published March 3, 2025
Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT in github.com/distribution/distribution
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| kots | Chainguard | 1.124.3-r1 |
| zot | Chainguard | 2.1.2-r2 |
| harbor-fips-2.12 | Chainguard | 2.12.4-r41 |
| harbor-2.12 | Chainguard | 2.12.4-r43 |
| kots | Wolfi | 1.124.3-r1 |
| zot | Wolfi | 2.1.2-r2 |
Affected products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | harbor-fips-2.13 | * |
| chainguard | kots | 0 |
| chainguard | zot | 0 |
| github.com | distribution/distribution | 0 |
| chainguard | harbor-fips-2.12 | 0 |
| chainguard | harbor-fips-2.15 | * |
| chainguard | harbor-2.15 | * |
| wolfi | harbor-2.14 | * |
| chainguard | harbor-2.12 | 0 |
| chainguard | harbor-2.14 | * |
| wolfi | kots | 0 |
| chainguard | harbor-2.13 | * |
| wolfi | zot | 0 |
| chainguard | harbor-fips-2.14 | * |
Timeline
- Mar 3, 2025 CVE Published
- Feb 4, 2026 CVE Updated
- May 18, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GO-2025-3460
vulnetix vdb fixes GO-2025-3460Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GO-2025-3460/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart