Skip to content
Log inStart free trial

GHSA-mc8v-mgrf-8f4m CVE-2021-41190

Clarify Content-Type handling

Low Go
Severity
3.0 / 10
Low · CVSS 3.1
Exploit chance (EPSS)
2.22%
Chance of exploitation in the next 30 days. Higher than 82.70% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
Fix
1.0.1
Upgrade github.com/opencontainers/distribution-spec to this version or later

Description

Impact

In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently.

Patches

The OCI Distribution Specification will be updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations.

Workarounds

Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields.

References

https://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-xpmg-72qh

For more information

If you have any questions or comments about this advisory:

Affected versions

Go

PackageVulnerableFixed in
github.com/opencontainers/distribution-spec
< 1.0.1
1.0.1

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/opencontainers/distribution-spec Go → 1.0.1

go
go get github.com/opencontainers/distribution-spec@v1.0.1 && go mod tidy

Severity breakdown

CVSS 3.1 3.0

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N

Attack vector
Network
Attack complexity
High
Privileges required
Low
User interaction
Required
Scope
Changed
Confidentiality
None
Integrity
Low
Availability
None

Weakness

CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-9pvw-hwfg-92h5
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Medium Same weakness, CWE-843
GHSA-897f-g5gm-fmxm
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
Critical Same weakness, CWE-843
GHSA-8r5x-fm3f-whwj
Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)
Critical Same weakness, CWE-843
GHSA-r9w8-h9r3-54w4
devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation
High Same weakness, CWE-843
GHSA-j6r3-76f7-8jcv
ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range
Medium Same weakness, CWE-843
CVE-2026-85046
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
High Known exploited Same weakness, CWE-843
GHSA-32r8-5843-4qw2
Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure
High Same weakness, CWE-843
GHSA-2x35-3fw4-9jr4
n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion
High Same weakness, CWE-843
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor