Every CVE Search/ Get API key

CVE-2026-35172

Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation

7.5 HighFix available

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again. This vulnerability is fixed in 3.1.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.47%Up 0.4 points since Apr 7, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again. This vulnerability is fixed in 3.1.0.

Record
CVE-2026-35172
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-284, CWE-524
Updated
2026-11-02
EUVDEUVD-2026-19446 7.5

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again. This vulnerability is fixed in 3.1.0.

Record
EUVD-2026-19446
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-f2g3-hh2r-cwgc 7.5

Distribution: stale blob access resurrection via repo-scoped redis descriptor cache invalidation

summary:

distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. the delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again.

Severity

HIGH

justification: this is a repo-local authorization bypass after explicit delete, with concrete confidentiality impact and no requirement for write access after the delete event. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5). CWE-284.

affected version

details

the backend access model is repository-link based: once repo a deletes its blob link, later reads from repo a should continue returning ErrBlobUnknown even if the same digest remains linked in repo b.

the issue is the split invalidation path in the redis cache backend:

  1. linkedBlobStore.Delete calls blobAccessController.Clear during repository delete handling.
  2. cachedBlobStatter.Clear forwards that invalidation into the cache layer.
  3. repositoryScopedRedisBlobDescriptorService.Clear checks that the digest is a member of repo a, but then only calls upstream.Clear.
  4. upstream.Clear deletes the shared digest descriptor and does not remove the digest from the repository membership set for repo a.
  5. when repo b later stats or gets the same digest, the shared descriptor is recreated.
  6. repositoryScopedRedisBlobDescriptorService.Stat for repo a accepts the stale membership and now trusts the repopulated shared descriptor, restoring access in the repository that already deleted its link.

this creates a revocation gap at the repository boundary. the blob is briefly inaccessible from repo a right after delete, which confirms the backend link was removed, and then becomes accessible again only because stale redis membership survived while a peer repository repopulated the shared descriptor.

attack scenario

  1. an operator runs distribution with storage.cache.blobdescriptor: redis and storage.delete.enabled: true.
  2. the same digest exists in both repo a and repo b.
  3. the operator deletes the blob from repo a and expects repository-local access to be revoked.
  4. repo a correctly returns blob unknown immediately after the delete.
  5. an anonymous or unprivileged user requests the same digest from repo b, which still legitimately owns it and repopulates the shared descriptor.
  6. a later request for the digest from repo a succeeds again because stale repo-a membership was never revoked from redis.

PoC

attachment: poc.zip

the attached PoC is a deterministic integration harness using miniredis and the pinned distribution source tree.

steps to reproduce

canonical:

unzip -q -o poc.zip -d poc
cd poc
make canonical

expected output:

[CALLSITE_HIT]: repositoryScopedRedisBlobDescriptorService.Clear->upstream.Clear->repositoryScopedRedisBlobDescriptorService.Stat
[PROOF_MARKER]: repo_a_access_restored=true repo_a_delete_miss=true…
Record
GHSA-f2g3-hh2r-cwgc
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-284
Updated
2026-11-02
NVD 7.5

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again. This vulnerability is fixed in 3.1.0.

Record
CVE-2026-35172
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-284, CWE-524
Updated
2026-11-02
OSV 7.5

Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again. This vulnerability is fixed in 3.1.0.

Record
CVE-2026-35172
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-284
Updated
2026-11-02
OSVDEBIAN-CVE-2026-35172 7.5

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again. This vulnerability is fixed in 3.1.0.

Record
DEBIAN-CVE-2026-35172
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 10 moreShow less
OSVGHSA-f2g3-hh2r-cwgc 7.5

Distribution: stale blob access resurrection via repo-scoped redis descriptor cache invalidation

summary:

distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. the delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again.

Severity

HIGH

justification: this is a repo-local authorization bypass after explicit delete, with concrete confidentiality impact and no requirement for write access after the delete event. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5). CWE-284.

affected version

details

the backend access model is repository-link based: once repo a deletes its blob link, later reads from repo a should continue returning ErrBlobUnknown even if the same digest remains linked in repo b.

the issue is the split invalidation path in the redis cache backend:

  1. linkedBlobStore.Delete calls blobAccessController.Clear during repository delete handling.
  2. cachedBlobStatter.Clear forwards that invalidation into the cache layer.
  3. repositoryScopedRedisBlobDescriptorService.Clear checks that the digest is a member of repo a, but then only calls upstream.Clear.
  4. upstream.Clear deletes the shared digest descriptor and does not remove the digest from the repository membership set for repo a.
  5. when repo b later stats or gets the same digest, the shared descriptor is recreated.
  6. repositoryScopedRedisBlobDescriptorService.Stat for repo a accepts the stale membership and now trusts the repopulated shared descriptor, restoring access in the repository that already deleted its link.

this creates a revocation gap at the repository boundary. the blob is briefly inaccessible from repo a right after delete, which confirms the backend link was removed, and then becomes accessible again only because stale redis membership survived while a peer repository repopulated the shared descriptor.

attack scenario

  1. an operator runs distribution with storage.cache.blobdescriptor: redis and storage.delete.enabled: true.
  2. the same digest exists in both repo a and repo b.
  3. the operator deletes the blob from repo a and expects repository-local access to be revoked.
  4. repo a correctly returns blob unknown immediately after the delete.
  5. an anonymous or unprivileged user requests the same digest from repo b, which still legitimately owns it and repopulates the shared descriptor.
  6. a later request for the digest from repo a succeeds again because stale repo-a membership was never revoked from redis.

PoC

attachment: poc.zip

the attached PoC is a deterministic integration harness using miniredis and the pinned distribution source tree.

steps to reproduce

canonical:

unzip -q -o poc.zip -d poc
cd poc
make canonical

expected output:

[CALLSITE_HIT]: repositoryScopedRedisBlobDescriptorService.Clear->upstream.Clear->repositoryScopedRedisBlobDescriptorService.Stat
[PROOF_MARKER]: repo_a_access_restored=true repo_a_delete_miss=true…
Record
GHSA-f2g3-hh2r-cwgc
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-284
Updated
2026-11-02
OSVUBUNTU-CVE-2026-35172 7.5

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again. This vulnerability is fixed in 3.1.0.

Record
UBUNTU-CVE-2026-35172
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVBIT-distribution-2026-35172 No score

Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again. This vulnerability is fixed in 3.1.0.

Record
BIT-distribution-2026-35172
Updated
2026-11-02
OSVGO-2026-4942 No score

Stale blob descriptor cache invalidation in github.com/distribution/distribution

In github.com/distribution/distribution and github.com/distribution/distribution/v3 before 3.1.0, when storage.cache.blobdescriptor is configured with redis and storage.delete.enabled is true, deleting a blob in one repository clears the shared digest descriptor in Redis but leaves stale repository-scoped membership behind. If another repository subsequently requests or stats the same digest, the shared descriptor is repopulated and the deleted blob becomes accessible again in the first repository.

Record
GO-2026-4942
Updated
2026-11-02
OSVopenSUSE-SU-2026:10631-1 No score

distribution-registry-3.1.0-1.1 on GA media

These are all security issues fixed in the distribution-registry-3.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10631-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20686-1 No score

Security update for distribution

This update for distribution fixes the following issues

Security issues:

  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260283).
  • CVE-2026-33540: information disclosure via improper validation of authentication realm URL (bsc#1261793).
  • CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262951).
  • CVE-2026-35172: information disclosure via stale references after content deletion (bsc#1262096).

Non security issues:

  • add distribution-registry.tmpfiles (jsc#PED-14747).
  • distribution builds against go1.24 EOL (bsc#1259718).

Changes for distribution:

  • update to 3.1.0
  • Adds support for tag pagination
  • Fixes default credentials in Azure storage provider
  • Drops support for go1.23 and go1.24 and updates to go1.25
  • See the full changelog below for the full list of changes.
  • docs: Update to refer to new image tag v3
  • Fix default_credentials in azure storage provider
  • chore: make function comment match function name
  • build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 in the go_modules group across 1 directory
  • fix: implement JWK thumbprint for Ed25519 public keys
  • fix: Annotate code block from validation.indexes configuration docs
  • feat: extract redis config to separate struct
  • Fix: resolve issue #4478 by using a temporary file for non- append writes
  • build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2
  • docs: Add note about OTEL_TRACES_EXPORTER
  • fix: set OTEL traces to disabled by default
  • Fix markdown syntax for OTEL traces link in docs
  • Switch UUIDs to UUIDv7
  • refactor: replace map iteration with maps.Copy/Clone
  • s3-aws: fix build for 386
  • docs: Add OpenTelemetry links to quickstart docs
  • Fix S3 driver loglevel param
  • Fixed data race in TestSchedule test
  • Fixes #4683 - uses X/Y instead of Gx/Gy for thumbprint of ecdsa keys
  • build(deps): bump actions/checkout from 4 to 5
  • Fix broken link to Docker Hub fair use policy
  • fix(registry/handlers/app): redis CAs
  • build(deps): bump actions/labeler from 5 to 6
  • build(deps): bump actions/setup-go from 5 to 6
  • build(deps): bump actions/upload-pages-artifact from 3 to 4
  • build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3
  • build(deps): bump github/codeql-action from 3.26.5 to 4.30.7
  • build(deps): bump github/codeql-action from 4.30.7 to 4.30.8
  • chore: labeler: add area/client mapping for internal/client/**
  • client: add Accept headers to Exists() HEAD
  • feat(registry): Make graceful shutdown test robust
  • fix(registry): Correct log formatting for upstream challenge
  • build(deps): bump github/codeql-action from 4.30.8 to 4.30.9
  • build(deps): bump github/codeql-action from 4.30.9 to 4.31.3
  • refactor: remove redundant variable declarations in for loops
  • "should" -> "must" regarding redis eviction policy
  • build(deps): bump actions/checkout from 5 to 6
  • Incorrect warning hint
  • Add return error when list object
  • build(deps): bump actions/checkout from 5.0.1 to 6.0.0
  • build(deps): bump peter-evans/dockerhub-description from 4 to 5
  • fix: Logging regression for manifest HEAD requests
  • Add boolean parsing util
  • Expose useFIPSEndpoint for S3
  • Add Cloudfleet Container Registry to adopters
  • fix(ci): Fix broken Azure e2e storage tests
  • BUG: Fix notification filtering to work with actions when mediatypes is empty
  • build(deps): bump actions/checkout from 6.0.0 to 6.0.1
  • build(deps): bump actions/upload-artifact from 4.6.2 to 6.0.0
  • build(deps): bump github/codeql-action from 4.31.3 to 4.31.10
  • build(deps): bump github/codeql-action from 4.31.10 to 4.32.2
  • build(deps): bump actions/checkout from 6.0.1 to 6.0.2
  • update golangci-lint to v2.9 and fix linting issues
  • update to go1.25.7, alpine 3.23, xx v1.9.0
  • vendor: github.com/sirupsen/logrus v1.9.4
  • vendor: update golang.org/x/* dependencies …
Record
openSUSE-SU-2026:20686-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21761-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-5026 CVE-2026-39821
    • GO-2026-6225
    • GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw
    • GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h
    • GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q
    • GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6
    • GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86
    • GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p
    • GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6
    • GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68
    • GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v
    • GO-2026-6262 GHSA-22w5-2fxg-vrwx
    • GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28
    • GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j
    • GO-2026-6265 GHSA-8fxq-53rx-ph5f
    • GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m
    • GO-2026-6267 GHSA-h58c-xccx-75m3
    • GO-2026-6268 GHSA-q9c5-pp7m-fm2g
    • GO-2026-6269 GHSA-rxhg-vcww-2mpw
    • GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5
    • GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m
    • GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97
    • GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28
    • GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w
    • GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34
    • GO-2026-6277 GHSA-4ph6-mjv7-3fq6
    • GO-2026-6278 GHSA-w67g-5rqw-f597
    • GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v
    • GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw
    • GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4
    • GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9
    • GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q
    • GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg
    • GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr
    • GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4
    • GO-2026-6287 GHSA-vx2m-jpxr-xv7w
    • GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr
    • GO-2026-6289 GHSA-w8j7-39hp-8x59
    • GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3
    • GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58
    • GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m
    • GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq
    • GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff
    • GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx
    • GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9
    • GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm
    • GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp
    • GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px
    • GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf
    • GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf

  • Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-4720 GHSA-v3mg-9v85-fcm7
    • GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc
    • GO-2026-4950
    • GO-2026-6093 GHSA-464c-974j-9xm6
    • GO-2026-6094 GHSA-gcjh-h69q-9w9g
    • GO-2026-6095 GHSA-r277-6w6q-xmqw
    • GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737
    • GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv
    • GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q
    • GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv
    • GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf
    • GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8
    • GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp
    • GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp
    • GO-2026-6105 GHSA-c534-2w9c-x7fm
    • GO-2026-6106 GHSA-v6w6-358x-2433
    • GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3
    • GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq
    • GO-2026-6109 GHSA-86cx-wwf4-phq4
    • GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75
    • GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h
    • GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq
    • GO-2026-6113 GHSA-p6ph-3jx2-3337
    • GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8
    • GO-2026-6115 CVE-2026-56867
    • GO-2026-6117 GHSA-hp74-gm6m-2qm5
    • GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7
    • GO-2026-6119 CVE-2026-43983…
Record
openSUSE-SU-2026:21761-1
Updated
2026-11-02
OSVSUSE-SU-2026:21560-1 No score

Security update for distribution

This update for distribution fixes the following issues

Security issues:

  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260283).
  • CVE-2026-33540: information disclosure via improper validation of authentication realm URL (bsc#1261793).
  • CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262951).
  • CVE-2026-35172: information disclosure via stale references after content deletion (bsc#1262096).

Non security issues:

  • add distribution-registry.tmpfiles (jsc#PED-14747).
  • distribution builds against go1.24 EOL (bsc#1259718).

Changes for distribution:

  • update to 3.1.0
  • Adds support for tag pagination
  • Fixes default credentials in Azure storage provider
  • Drops support for go1.23 and go1.24 and updates to go1.25
  • See the full changelog below for the full list of changes.
  • docs: Update to refer to new image tag v3
  • Fix default_credentials in azure storage provider
  • chore: make function comment match function name
  • build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 in the go_modules group across 1 directory
  • fix: implement JWK thumbprint for Ed25519 public keys
  • fix: Annotate code block from validation.indexes configuration docs
  • feat: extract redis config to separate struct
  • Fix: resolve issue #4478 by using a temporary file for non- append writes
  • build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2
  • docs: Add note about OTEL_TRACES_EXPORTER
  • fix: set OTEL traces to disabled by default
  • Fix markdown syntax for OTEL traces link in docs
  • Switch UUIDs to UUIDv7
  • refactor: replace map iteration with maps.Copy/Clone
  • s3-aws: fix build for 386
  • docs: Add OpenTelemetry links to quickstart docs
  • Fix S3 driver loglevel param
  • Fixed data race in TestSchedule test
  • Fixes #4683 - uses X/Y instead of Gx/Gy for thumbprint of ecdsa keys
  • build(deps): bump actions/checkout from 4 to 5
  • Fix broken link to Docker Hub fair use policy
  • fix(registry/handlers/app): redis CAs
  • build(deps): bump actions/labeler from 5 to 6
  • build(deps): bump actions/setup-go from 5 to 6
  • build(deps): bump actions/upload-pages-artifact from 3 to 4
  • build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3
  • build(deps): bump github/codeql-action from 3.26.5 to 4.30.7
  • build(deps): bump github/codeql-action from 4.30.7 to 4.30.8
  • chore: labeler: add area/client mapping for internal/client/**
  • client: add Accept headers to Exists() HEAD
  • feat(registry): Make graceful shutdown test robust
  • fix(registry): Correct log formatting for upstream challenge
  • build(deps): bump github/codeql-action from 4.30.8 to 4.30.9
  • build(deps): bump github/codeql-action from 4.30.9 to 4.31.3
  • refactor: remove redundant variable declarations in for loops
  • "should" -> "must" regarding redis eviction policy
  • build(deps): bump actions/checkout from 5 to 6
  • Incorrect warning hint
  • Add return error when list object
  • build(deps): bump actions/checkout from 5.0.1 to 6.0.0
  • build(deps): bump peter-evans/dockerhub-description from 4 to 5
  • fix: Logging regression for manifest HEAD requests
  • Add boolean parsing util
  • Expose useFIPSEndpoint for S3
  • Add Cloudfleet Container Registry to adopters
  • fix(ci): Fix broken Azure e2e storage tests
  • BUG: Fix notification filtering to work with actions when mediatypes is empty
  • build(deps): bump actions/checkout from 6.0.0 to 6.0.1
  • build(deps): bump actions/upload-artifact from 4.6.2 to 6.0.0
  • build(deps): bump github/codeql-action from 4.31.3 to 4.31.10
  • build(deps): bump github/codeql-action from 4.31.10 to 4.32.2
  • build(deps): bump actions/checkout from 6.0.1 to 6.0.2
  • update golangci-lint to v2.9 and fix linting issues
  • update to go1.25.7, alpine 3.23, xx v1.9.0
  • vendor: github.com/sirupsen/logrus v1.9.4
  • vendor: update golang.org/x/* dependencies …
Record
SUSE-SU-2026:21560-1
Updated
2026-11-02
OSVSUSE-SU-2026:23625-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-5026 CVE-2026-39821
    • GO-2026-6225
    • GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw
    • GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h
    • GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q
    • GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6
    • GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86
    • GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p
    • GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6
    • GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68
    • GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v
    • GO-2026-6262 GHSA-22w5-2fxg-vrwx
    • GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28
    • GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j
    • GO-2026-6265 GHSA-8fxq-53rx-ph5f
    • GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m
    • GO-2026-6267 GHSA-h58c-xccx-75m3
    • GO-2026-6268 GHSA-q9c5-pp7m-fm2g
    • GO-2026-6269 GHSA-rxhg-vcww-2mpw
    • GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5
    • GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m
    • GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97
    • GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28
    • GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w
    • GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34
    • GO-2026-6277 GHSA-4ph6-mjv7-3fq6
    • GO-2026-6278 GHSA-w67g-5rqw-f597
    • GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v
    • GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw
    • GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4
    • GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9
    • GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q
    • GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg
    • GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr
    • GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4
    • GO-2026-6287 GHSA-vx2m-jpxr-xv7w
    • GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr
    • GO-2026-6289 GHSA-w8j7-39hp-8x59
    • GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3
    • GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58
    • GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m
    • GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq
    • GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff
    • GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx
    • GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9
    • GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm
    • GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp
    • GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px
    • GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf
    • GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf

  • Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-4720 GHSA-v3mg-9v85-fcm7
    • GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc
    • GO-2026-4950
    • GO-2026-6093 GHSA-464c-974j-9xm6
    • GO-2026-6094 GHSA-gcjh-h69q-9w9g
    • GO-2026-6095 GHSA-r277-6w6q-xmqw
    • GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737
    • GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv
    • GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q
    • GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv
    • GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf
    • GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8
    • GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp
    • GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp
    • GO-2026-6105 GHSA-c534-2w9c-x7fm
    • GO-2026-6106 GHSA-v6w6-358x-2433
    • GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3
    • GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq
    • GO-2026-6109 GHSA-86cx-wwf4-phq4
    • GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75
    • GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h
    • GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq
    • GO-2026-6113 GHSA-p6ph-3jx2-3337
    • GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8
    • GO-2026-6115 CVE-2026-56867
    • GO-2026-6117 GHSA-hp74-gm6m-2qm5
    • GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7
    • GO-2026-6119 CVE-2026-43983…
Record
SUSE-SU-2026:23625-1
Updated
2026-11-02
OSVSUSE-SU-2026:4212-1 No score

Security update for distribution

This update for distribution fixes the following issues:

Security issues fixed:

  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260283).
  • CVE-2026-33540: information disclosure via improper validation of authentication realm URL (bsc#1261793).
  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265788).
  • CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262951).
  • CVE-2026-35172: information disclosure via stale references after content deletion (bsc#1262096).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266629).
  • CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831, CVE-2026-39832,CVE-2026-39833,CVE-2026-39834,CVE-2026-39835,CVE-2026-42508, CVE-2026-46595,CVE-2026-46597,CVE-2026-46598: golang.org/x/crypto/ssh: multiple issues (bsc#1268884).
  • CVE-2026-41888: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265429).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272132).

Changes for distribution:

Update to 3.1.1:

  • Bounds-check the file basename in PurgeUploads Walk callback
  • Add S3 Express One Zone support to the S3 storage driver
  • Fix tag list endpoint in proxy mode
  • Clamp oversized n query parameter in proxy mode instead of returning 400
  • See the full changelog below for the full list of changes.
  • internal/client/auth/challenge: cleanups and minor refactor
  • build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp from 0.18.0 to 0.19.0 in the go_modules group across 1 directory
  • build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otl ptrace/otlptracehttp from 1.42.0 to 1.43.0 in the go_modules group across 1 directory
  • build(deps): bump github/codeql-action from 4.34.1 to 4.35.1
  • chore(build): Bump go version to latest
  • refactor: use slices.Backward to simplify the code
  • fix(proxy): fix tag list endpoint in proxy mode
  • Update docker-compose structure in deploying.md
  • build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1
  • build(deps): bump actions/upload-pages-artifact from 4.0.0 to 5.0.0
  • build(deps): bump docker/login-action from 4.0.0 to 4.1.0
  • build(deps): bump docker/bake-action from 7.0.0 to 7.1.0
  • fix(proxy): clamp oversized n query param instead of
  • feat(s3): add express zone one support to S3 driver
  • fix(storage): bounds-check the file basename in PurgeUploads Walk callback
  • chore(release): prepare for v3.1.1 release
  • Adds support for tag pagination
  • Fixes default credentials in Azure storage provider
  • Drops support for go1.23 and go1.24 and updates to go1.25
  • docs: Update to refer to new image tag v3
  • Fix default_credentials in azure storage provider
  • chore: make function comment match function name
  • build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 in the go_modules group across 1 directory
  • fix: implement JWK thumbprint for Ed25519 public keys
  • fix: Annotate code block from validation.indexes configuration docs
  • feat: extract redis config to separate struct
  • Fix: resolve issue #4478 by using a temporary file for non- append writes
  • build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2
  • docs: Add note about OTEL_TRACES_EXPORTER
  • fix: set OTEL traces to disabled by default
  • Fix markdown syntax for OTEL traces link in docs
  • Switch UUIDs to UUIDv7
  • refactor: replace map iteration with maps.Copy/Clone
  • s3-aws: fix build for 386
  • docs: Add OpenTelemetry links to quickstart docs
  • Fix S3 driver loglevel param
  • Fixed data race in TestSchedule test
  • Fixes #4683 - uses X/Y instead of Gx/Gy for thumbprint of ecdsa keys *…
Record
SUSE-SU-2026:4212-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/distribution/distribution/v3
Go
 before 3.1.0
3.1.0
github.com/distribution/distribution
Go
 through 2.8.3 None known
distribution
Bitnami
 before 3.1.0
3.1.0
docker-registry
Debian:12
 All versions, plus listed versions
2.8.2+ds1-12.8.3+ds1-12.8.3+ds1-22.8.3+ds1-3
 None known
docker-registry
Debian:13
 All versions, plus listed versions
2.8.3+ds1-22.8.3+ds1-3
 None known
docker-registry
Debian:14
 before 2.8.3+ds1-3, plus listed versions
2.8.3+ds1-2
2.8.3+ds1-3
github.com/distribution/distribution
Go
 All versions None known
govulncheck-vulndb
SUSE:Linux Enterprise Server 16.0
From an advisory covering 181 CVEs
 before 0.0.20260827T195228-160000.1.1
0.0.20260827T195228-160000.1.1
govulncheck-vulndb
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 181 CVEs
 before 0.0.20260827T195228-160000.1.1
0.0.20260827T195228-160000.1.1
distribution
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
Show 20 moreShow less
Affected packages
PackageAffectedFixed
distribution
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
docker-registry
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.1.1~ds1-42.1.1~ds1-4ubuntu12.3.0~ds1-12.3.0~ds1-1ubuntu0.1~esm1
 None known
docker-registry
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.6.2~ds1-12.6.2~ds1-1ubuntu0.1~esm1
 None known
docker-registry
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.6.2~ds1-22.7.1~ds1-22.7.1~ds1-32.7.1~ds1-42.7.1+ds2-5
Show 4 moreShow less
2.7.1+ds2-72.7.1+ds2-7ubuntu0.12.7.1+ds2-7ubuntu0.22.7.1+ds2-7ubuntu0.3
 None known
docker-registry
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.7.1+ds2-7build22.8.0+ds1-42.8.0+ds1-4ubuntu0.1~esm12.8.0+ds1-4ubuntu0.1~esm22.8.0+ds1-4ubuntu0.1~esm3
 None known
docker-registry
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.8.2+ds1-1build12.8.2+ds1-1ubuntu0.24.04.12.8.2+ds1-1ubuntu0.24.04.22.8.2+ds1-1ubuntu0.24.04.3
 None known
docker-registry
Ubuntu:25.10
 All versions, plus listed versions
2.8.3+ds1-2
 None known
docker-registry
Ubuntu:26.10
 All versions, plus listed versions
2.8.3+ds1-2build12.8.3+ds1-3
 None known
docker-registry
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
2.8.3+ds1-22.8.3+ds1-2build12.8.3+ds1-2ubuntu0.26.04.1~esm1
 None known
distribution
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 3.1.0-1.1
3.1.0-1.1
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 181 CVEs
 before 0.0.20260827T195228-160000.1.1
0.0.20260827T195228-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-35172 is a high vulnerability (CVSS 7.5) in Distribution, published April 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 41st percentile. Fixed in github.com/distribution/distribution/v3 3.1.0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 28 references and the rest of 7 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open