CVE-2025-24882: regclient may ignore pinned manifest digests

Severity: medium (CVSS 5.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-01-29 · updated 2026-06-17
Weakness: CWE-20

Description

regclient is a Docker and OCI Registry Client in Go. A malicious registry could return a different digest for a pinned manifest without detection. This vulnerability is fixed in 0.7.1.

Affected products

regclient: before 0.7.1

References

https://github.com/regclient/regclient/commit/7d17cff26c22196b5ddd66bda8c5ee4abf3d1269
https://github.com/regclient/regclient/security/advisories/GHSA-qv35-3gw6-8q4j

Get alerted when CVE-2025-24882 or the next vulnerability affects your stack