diff --git a/pkg/name/tag.go b/pkg/name/tag.go
index 66bd1bec3..2e46d706b 100644
--- a/pkg/name/tag.go
+++ b/pkg/name/tag.go
@@ -80,6 +80,9 @@ func NewTag(name string, opts ...Option) (Tag, error) {
 	if len(parts) > 1 && !strings.Contains(parts[len(parts)-1], regRepoDelimiter) {
 		base = strings.Join(parts[:len(parts)-1], tagDelim)
 		tag = parts[len(parts)-1]
+		if tag == "" {
+			return Tag{}, newErrBadName("%s must specify a tag name after the colon", name)
+		}
 	}
 
 	// We don't require a tag, but if we get one check it's valid,
diff --git a/pkg/name/tag_test.go b/pkg/name/tag_test.go
index e340566f1..81bedddac 100644
--- a/pkg/name/tag_test.go
+++ b/pkg/name/tag_test.go
@@ -40,6 +40,7 @@ var badTagNames = []string{
 	"gcr.io/project-id/bad_chars:c@n'tuse",
 	"gcr.io/project-id/wrong-length:white space",
 	"gcr.io/project-id/too-many-chars:thisisthetagthatneverendsitgoesonandonmyfriendsomepeoplestartedtaggingitnotknowingwhatitwasandtheyllcontinuetaggingitforeverjustbecausethisisthetagthatneverends",
+	"library/ubuntu:",
 }
 
 func TestNewTagStrictValidation(t *testing.T) {