GO-2026-4942
Stale blob descriptor cache invalidation in github.com/distribution/distribution
At a glance
- Published
- Updated
- CVE
- CVE-2026-35172
- Aliases
- BIT-distribution-2026-35172, GHSA-f2g3-hh2r-cwgc
Description
In github.com/distribution/distribution and github.com/distribution/distribution/v3 before 3.1.0, when storage.cache.blobdescriptor is configured with redis and storage.delete.enabled is true, deleting a blob in one repository clears the shared digest descriptor in Redis but leaves stale repository-scoped membership behind. If another repository subsequently requests or stats the same digest, the shared descriptor is repopulated and the deleted blob becomes accessible again in the first repository.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/distribution/distribution | introduced 0 |
| Go · github.com/distribution/distribution/v3 | introduced 0, fixed 3.1.0 |
References
- https://github.com/distribution/distribution/security/advisories/GHSA-f2g3-hh2r-cwgc ADVISORY
- https://github.com/distribution/distribution/commit/078b0783f239b4115d1a979e66f08832084e9d1d FIX
- https://github.com/golang/vulndb/issues/4942 REPORT
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |