Distribution: Client `manifests.Get()` does not verify returned content against requested digest (CVE-2026-85747)

The vulnerability exists in the Docker distribution client code where the Get() method fetches a manifest by digest but does not compute and verify the digest of the returned manifest content against the requested digest. Instead, it trusts the server-supplied Docker-Content-Digest header, which can be forged by an attacker controlling the registry or performing a MITM attack. This allows an attacker to substitute arbitrary manifest bytes for a digest-pinned request, bypassing content integrity guarantees. The pull-through proxy component consumes these manifests without re-verification, enabling persistent cache poisoning.

An attacker who controls or intercepts the registry connection can serve malicious manifest content that is accepted by the client as valid despite digest pinning. This breaks the fundamental security assumption of content-addressable integrity, potentially leading to supply-chain compromise. The pull-through proxy can cache and propagate poisoned manifests, affecting all downstream consumers relying on it.

A patch is available to fix this issue by verifying the manifest content digest against the requested digest. Users should update to a fixed version of github.com/docker/distribution. Until patched, users should be aware that digest pinning does not guarantee integrity if the registry or connection is compromised. No vendor advisory content contradicts this; therefore, applying the official fix is recommended.