CVE-2025-24882: regclient Manifest Digest Bypass Vulnerability

CVE-2025-24882 Overview

CVE-2025-24882 affects regclient, a Docker and Open Container Initiative (OCI) Registry Client written in Go. A malicious registry can return a manifest with a digest different from the one pinned by the client, and the mismatch goes undetected. This breaks the integrity guarantee that digest pinning is supposed to provide, allowing tampered or substituted container manifests to be accepted as authentic. The issue is tracked under [CWE-20: Improper Input Validation] and is fixed in regclient version 0.7.1.

Critical Impact
A compromised or malicious registry can serve arbitrary manifest content in place of a pinned digest, undermining supply chain trust for container images pulled with regclient.

Affected Products

regclient versions prior to 0.7.1
Applications and CI/CD tooling embedding the regclient Go library
Container workflows relying on regclient for digest-pinned manifest retrieval

Discovery Timeline

2025-01-29 - CVE-2025-24882 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24882

Vulnerability Analysis

regclient supports referencing container manifests by digest, a cryptographic hash that clients use to guarantee they receive the exact content they expect. When a client requests a manifest by digest, the returned bytes must hash to that digest; otherwise the response should be rejected.

In affected versions, regclient did not consistently validate that the digest of the returned manifest matched the digest supplied in the reference. A registry could therefore return content with a different digest than the one requested, and regclient would accept it as the pinned manifest. This weakens container supply chain integrity, particularly for pipelines that rely on digest pinning to defend against registry compromise or man-in-the-middle tampering.

Exploitation requires an attacker to control or influence a registry the client interacts with, plus a user action that triggers the manifest fetch. Impact centers on integrity: a substituted manifest can point at attacker-controlled layers or configuration.

Root Cause

The root cause is missing digest validation in the manifest construction path. In scheme/reg/referrer.go, the reference was passed to manifest.New without stripping the digest, and manifest.New in types/manifest/manifest.go did not enforce a comparison between the reference digest and the computed digest of the received bytes. The Exploit Prediction Scoring System (EPSS) probability is 0.178%.

Attack Vector

The attack requires network access to a registry endpoint that the victim client contacts, high privileges on that registry (or an equivalent MITM position), and a user-initiated pull. On success, integrity is compromised while confidentiality impact is limited and availability is unaffected.

// Security patch in scheme/reg/referrer.go
// Fix: clear the digest from the ref before constructing the manifest,
// forcing digest validation to occur against the descriptor/headers.
 	m, err := manifest.New(
-		manifest.WithRef(r),
+		manifest.WithRef(r.SetDigest("")),
 		manifest.WithHeader(resp.HTTPResponse().Header),
 		manifest.WithRaw(rawBody),
 	)
// Source: https://github.com/regclient/regclient/commit/7d17cff26c22196b5ddd66bda8c5ee4abf3d1269

// Security patch in types/manifest/manifest.go
// The digest for the manifest will be checked against the descriptor,
// reference, or headers, depending on which is available first.
 func New(opts ...Opts) (Manifest, error) {
 	mc := manifestConfig{}
 	for _, opt := range opts {
// Source: https://github.com/regclient/regclient/commit/7d17cff26c22196b5ddd66bda8c5ee4abf3d1269

Detection Methods for CVE-2025-24882

Indicators of Compromise

Container manifests retrieved by digest whose recomputed SHA-256 does not match the requested digest.
Registry response logs showing manifest content served for digests the registry did not previously host.
Unexpected image layers or configuration blobs appearing in workloads that pull by pinned digest.

Detection Strategies

Inventory build and deployment systems using regclient (including tools such as regctl, regsync, and regbot) and confirm the linked library version.
Independently verify digests of pulled manifests using a second tool or an out-of-band hash comparison.
Audit registry traffic for pulls terminating at untrusted or newly introduced registry hostnames.

Monitoring Recommendations

Alert on regclient binaries or dependent applications running versions earlier than 0.7.1.
Monitor CI/CD pipelines for manifest pulls that deviate from expected digests recorded in source control.
Track outbound connections from build agents to registry endpoints and flag deviations from an allowlist.

How to Mitigate CVE-2025-24882

Immediate Actions Required

Upgrade regclient and any dependent tooling to version 0.7.1 or later.
Rebuild and redeploy applications that vendor the regclient Go module to pick up the fixed dependency.
Restrict container pulls to trusted, authenticated registries and revoke credentials for any registry suspected of compromise.

Patch Information

The fix is delivered in regclient 0.7.1 via commit 7d17cff26c22196b5ddd66bda8c5ee4abf3d1269. The patch ensures the digest supplied on the reference is validated against the digest computed from the descriptor, reference, or response headers, whichever is available first. See the GitHub Security Advisory GHSA-qv35-3gw6-8q4j and the upstream commit 7d17cff for details.

Workarounds

Pull manifests only from registries under direct organizational control until the upgrade is applied.
Perform an independent digest verification step after each manifest pull and fail the pipeline on mismatch.
Enforce TLS and mutual authentication to registry endpoints to reduce the risk of registry impersonation.

bash

# Upgrade the regclient command-line tools to a fixed release
go install github.com/regclient/regclient/cmd/regctl@v0.7.1
go install github.com/regclient/regclient/cmd/regsync@v0.7.1
go install github.com/regclient/regclient/cmd/regbot@v0.7.1

# For projects that import regclient as a library
go get github.com/regclient/regclient@v0.7.1
go mod tidy

# Independently verify a pulled manifest digest
regctl manifest get --format '{{ .GetDescriptor.Digest }}' <registry>/<repo>@sha256:<expected>