The client implementation in Distribution fails to verify that the content received for a digest‑pinned request matches the requested digest. Because the response body is not hashed and compared, an attacker can replace or substitute the manifest returned from the registry, even though the Docker‑Content‑Digest header claims the requested value. This weakness, classified as CWE‑354, breaks the integrity guarantee expected from a signed container image and permits delivery of malicious content to the runtime environment. The consequence is that an unauthenticated or MITM attacker could cause the target system to download, load, and execute code from a compromised or spoofed container manifest, effectively enabling remote code execution.

The vulnerability affects the distribution:distribution project, the open‑source container registry toolkit. All released versions prior to v3.1.2 are susceptible. The fix was released in version v3.1.2 and later releases are not affected.

The CVSS score of 6.8 indicates a moderate‑to‑high severity; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is a network‑level manipulation of a registry response or a compromised registry endpoint, allowing an attacker to inject a forged manifest during the image pull process. Because the flaw permits content substitution without the client performing integrity validation, exploitation does not require privileged access to the target system; any user who can direct a client's registry traffic to a malicious or compromised registry endpoint can trigger the vulnerability.