Is zotregistry.dev/zot safe to use?

zotregistry.dev/zot has 8 known vulnerabilities on the latest version (v1.4.3). DepScope rates its health at 26/100 (critical risk).

What is the latest version of zotregistry.dev/zot?

The latest version of zotregistry.dev/zot is v1.4.3, released 2022-11-30.

Does zotregistry.dev/zot have known vulnerabilities?

Yes. zotregistry.dev/zot has 8 known vulnerabilities. See depscope.dev/pkg/go/zotregistry.dev/zot for details.

Is zotregistry.dev/zot deprecated?

No, zotregistry.dev/zot is actively maintained. Latest release: v1.4.3 (2022-11-30).

What are alternatives to zotregistry.dev/zot?

DepScope has no curated alternatives for zotregistry.dev/zot at this time.

What license does zotregistry.dev/zot use?

License information for zotregistry.dev/zot is not declared in the registry metadata.

zotregistry.dev/zot

govv1.4.3

82 versions0 deps

/ 100

Health

update required

zotregistry.dev/[email protected] has vulnerabilities — update to latest

Update to >= 2.1.15 to fix known vulnerabilities

Low health score (26/100)
2 high severity vulnerabilities

Health breakdown0 – 100

0/25

maintenance

0/20

popularity

11/25

security

15/15

maturity

0/15

community

Vulnerabilities

2 high2 medium4 low

Advisories (8)

Severity	ID	Summary	Fixed in
medium	CVE-2024-39897	Cache driver GetBlob() allows read access to any blob without access control check	2.1.0
high	CVE-2026-31801	zot’s create-only policy allows overwrite attempts of existing latest tag (update permission not required)	2.1.15
medium	CVE-2025-48374	zot logs secrets	1.4.4-0.20250522160828-8a99a3ed231f
high	CVE-2025-23208	Zot IdP group membership revocation ignored	2.1.2
unknown	CVE-2024-39897	Cache driver GetBlob() allows read access to any blob without access control check in zotregistry.dev/zot	—
unknown	CVE-2025-23208	Zot IdP group membership revocation ignored in zotregistry.dev/zot	—
unknown	CVE-2025-48374	zot logs secrets in zotregistry.dev/zot	1.4.4-0.20250522160828-8a99a3ed231f
unknown	CVE-2026-31801	zot’s create-only policy allows overwrite attempts of existing latest tag (update permission not required) in zotregistry.dev/zot	2.1.15

Health History

Dependency Tree

License Audit

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/go/zotregistry.dev/zot

Last updated · 2022-11-30T07:35:06Z