Every CVE Search/ Get API key

CVE-2026-41888

Distribution: Tag deletion bypasses `storage.delete.enabled` configuration

6.3 MediumFix available

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.29%Up 0.3 points since May 15, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.3

Distribution: Tag deletion bypasses `storage.delete.enabled` configuration

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.

Record
CVE-2026-41888
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-863
Updated
2026-11-02
EUVDEUVD-2026-30341 6.3

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.

Record
EUVD-2026-30341
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-6pjf-3r9x-m592 6.3

Distribution's tag deletion bypasses `storage.delete.enabled` configuration

Summary

Tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion.

Details

When storage.delete.enabled is configured to false, digest-based manifest deletion is correctly rejected by the guard in registry/storage/linkedblobstore.go:212-215.

However, tag deletion takes a separate code path that never checks this setting:

In registry/handlers/manifests.go:439-453, DeleteManifest detects a tag reference, calls tagService.Untag(), returns, never consulting registry.deleteEnabled.

In turn, tagStore.Untag() calls the storage driver directly to delete the tag path without checking whether deletes are enabled.

PoC

Using a paired down Distribution configuration that explicitly disables deletes, such as this one, stored as config.yaml:

version: 0.1
storage:
  delete:
    enabled: false
  filesystem:
    rootdirectory: /var/lib/registry
http:
  addr: :5000

Start a local Distribution, mounting in the above configuration from the current directory:

docker run -p 5000:5000 -v "$(pwd)/config.yaml":/config.yaml --restart=always --name registry registry:3.1.0 /config.yaml

In a separate terminal session/tab, push alpine:3.23 into the running instance:

docker pull alpine:3.23
docker tag alpine:3.23 localhost:5000/alpine:3.23
docker push localhost:5000/alpine:3.23

Confirm that the tag shows up as expected:

curl 'http://localhost:5000/v2/alpine/tags/list'
{"name":"alpine","tags":["3.23"]}

Issue a delete for the 3.23 tag:

curl -X DELETE 'http://localhost:5000/v2/alpine/manifests/3.23'

Observe that the tag is now gone, despite deletes being disabled:

curl 'http://localhost:5000/v2/alpine/tags/list'
{"name":"alpine","tags":null}

Impact

This is an authorization bypass vulnerability. Any client with network access to the registry can delete tags despite the operator having disabled deletion. This can cause denial of service for consumers pulling by tag and enables supply-chain disruption by removing trusted tags from a registry that the operator and/or users believed to be immutable.

Record
GHSA-6pjf-3r9x-m592
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-863
Updated
2026-11-02
NVD 6.3

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.

Record
CVE-2026-41888
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-863
Updated
2026-11-02
OSV 6.3

Distribution: Tag deletion bypasses `storage.delete.enabled` configuration

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.

Record
CVE-2026-41888
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-863
Updated
2026-11-02
OSVDEBIAN-CVE-2026-41888 6.5

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.

Record
DEBIAN-CVE-2026-41888
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
Show 25 moreShow less
OSVGHSA-6pjf-3r9x-m592 6.3

Distribution's tag deletion bypasses `storage.delete.enabled` configuration

Summary

Tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion.

Details

When storage.delete.enabled is configured to false, digest-based manifest deletion is correctly rejected by the guard in registry/storage/linkedblobstore.go:212-215.

However, tag deletion takes a separate code path that never checks this setting:

In registry/handlers/manifests.go:439-453, DeleteManifest detects a tag reference, calls tagService.Untag(), returns, never consulting registry.deleteEnabled.

In turn, tagStore.Untag() calls the storage driver directly to delete the tag path without checking whether deletes are enabled.

PoC

Using a paired down Distribution configuration that explicitly disables deletes, such as this one, stored as config.yaml:

version: 0.1
storage:
  delete:
    enabled: false
  filesystem:
    rootdirectory: /var/lib/registry
http:
  addr: :5000

Start a local Distribution, mounting in the above configuration from the current directory:

docker run -p 5000:5000 -v "$(pwd)/config.yaml":/config.yaml --restart=always --name registry registry:3.1.0 /config.yaml

In a separate terminal session/tab, push alpine:3.23 into the running instance:

docker pull alpine:3.23
docker tag alpine:3.23 localhost:5000/alpine:3.23
docker push localhost:5000/alpine:3.23

Confirm that the tag shows up as expected:

curl 'http://localhost:5000/v2/alpine/tags/list'
{"name":"alpine","tags":["3.23"]}

Issue a delete for the 3.23 tag:

curl -X DELETE 'http://localhost:5000/v2/alpine/manifests/3.23'

Observe that the tag is now gone, despite deletes being disabled:

curl 'http://localhost:5000/v2/alpine/tags/list'
{"name":"alpine","tags":null}

Impact

This is an authorization bypass vulnerability. Any client with network access to the registry can delete tags despite the operator having disabled deletion. This can cause denial of service for consumers pulling by tag and enables supply-chain disruption by removing trusted tags from a registry that the operator and/or users believed to be immutable.

Record
GHSA-6pjf-3r9x-m592
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-863
Updated
2026-11-02
OSVUBUNTU-CVE-2026-41888 6.3

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.

Record
UBUNTU-CVE-2026-41888
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVBIT-distribution-2026-41888 No score

Distribution: Tag deletion bypasses `storage.delete.enabled` configuration

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.

Record
BIT-distribution-2026-41888
Updated
2026-11-02
OSVGO-2026-5185 No score

Distribution's tag deletion bypasses `storage.delete.enabled` configuration in github.com/distribution/distribution

Distribution's tag deletion bypasses storage.delete.enabled configuration in github.com/distribution/distribution

Record
GO-2026-5185
Updated
2026-11-02
OSVopenSUSE-SU-2026:10812-1 No score

distribution-registry-3.1.1-1.1 on GA media

These are all security issues fixed in the distribution-registry-3.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10812-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10814-1 No score

helm-4.2.0-1.1 on GA media

These are all security issues fixed in the helm-4.2.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10814-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10824-1 No score

helm3-3.21.0-1.1 on GA media

These are all security issues fixed in the helm3-3.21.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10824-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:11574-1 No score

hauler-2.0.3-1.1 on GA media

These are all security issues fixed in the hauler-2.0.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11574-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20860-1 No score

Security update for helm

This update for helm fixes the following issues

Security issues:

  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
  • CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).

Non security issue:

  • Update to version 3.21.0.
  • Fix packages for %suse_version bump (jsc#PED-15794)
Record
openSUSE-SU-2026:20860-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21084-1 No score

Security update for distribution

This update for distribution fixes the following issues

  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265788).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266629).
  • CVE-2026-41888: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265429).
  • CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266049).
  • CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266049).
  • CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266049).
  • CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266049).
  • CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266049).
  • CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266049).
  • CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266049).
  • CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266049).
  • CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266049).
  • CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266049).
  • CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266049).
  • CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266049).
  • CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266049).

Changes:

  • Bounds-check the file basename in PurgeUploads Walk callback
  • Add S3 Express One Zone support to the S3 storage driver
  • Fix tag list endpoint in proxy mode
  • Clamp oversized n query parameter in proxy mode instead of returning 400
  • See the full changelog below for the full list of changes.
  • internal/client/auth/challenge: cleanups and minor refactor
  • build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp from 0.18.0 to 0.19.0 in the go_modules group across 1 directory
  • build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otl ptrace/otlptracehttp from 1.42.0 to 1.43.0 in the go_modules group across 1 directory
  • build(deps): bump github/codeql-action from 4.34.1 to 4.35.1
  • chore(build): Bump go version to latest
  • refactor: use slices.Backward to simplify the code
  • fix(proxy): fix tag list endpoint in proxy mode
  • Update docker-compose structure in deploying.md
  • build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1
  • build(deps): bump actions/upload-pages-artifact from 4.0.0 to 5.0.0
  • build(deps): bump docker/login-action from 4.0.0 to 4.1.0
  • build(deps): bump docker/bake-action from 7.0.0 to 7.1.0
  • fix(proxy): clamp oversized n query param instead of
  • feat(s3): add express zone one support to S3 driver
  • fix(storage): bounds-check the file basename in PurgeUploads Walk callback
  • chore(release): prepare for v3.1.1 release
Record
openSUSE-SU-2026:21084-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21483-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj
  • GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c
  • GO-2026-5102 CVE-2026-45021 GHSA-3vcp-chfh-f6r2
  • GO-2026-5272 CVE-2026-40938 GHSA-94jr-7pqp-xhcq
  • GO-2026-5486 CVE-2026-40924 GHSA-m2cx-gpqf-qf74
  • GO-2026-5542 CVE-2026-40090 GHSA-pj97-4p9w-gx3q
  • GO-2026-5630 CVE-2026-25542 GHSA-rmx9-2pp3-xhcr
  • GO-2026-5643 CVE-2026-40923 GHSA-rx35-6rhx-7858
  • GO-2026-5675 CVE-2026-41492 GHSA-vvf7-6rmr-m29q
  • GO-2026-5711 CVE-2026-40161 GHSA-wjxp-xrpv-xpff
  • GO-2026-5746 CVE-2026-41567 GHSA-x86f-5xw2-fm2r
  • GO-2026-5749 CVE-2026-41328 GHSA-x92x-px7w-4gx4
  • GO-2026-5837 CVE-2026-44840 GHSA-q2m9-6jp9-c6mc
  • GO-2026-5929 CVE-2026-44342 GHSA-26v7-h57m-gh9m
  • GO-2026-5930 CVE-2026-33655 GHSA-6qcr-qxgr-m7fv
  • GO-2026-5933 GHSA-3g4q-2f67-2gvh
  • GO-2026-5934 GHSA-59qp-cfj3-rp64
  • GO-2026-5935 GHSA-7856-g3gv-9wq8
  • GO-2026-5936 CVE-2026-53552 GHSA-26rh-24rg-j3vv
  • GO-2026-5937 CVE-2026-53508 GHSA-2jcc-mxv7-p3f9
  • GO-2026-5938 CVE-2026-53553 GHSA-4g5x-hcwm-82jw
  • GO-2026-5939 CVE-2026-10517 GHSA-698x-9w2p-7vvp
  • GO-2026-5940 CVE-2026-53572 GHSA-6w3m-4hhp-775q
  • GO-2026-5941 CVE-2026-53487 GHSA-gvhc-wv3v-7pf8
  • GO-2026-5942 CVE-2026-46600
  • GO-2026-5944 CVE-2026-50197 GHSA-659f-rgp5-w4wf
  • GO-2026-5945 CVE-2026-6815 GHSA-rmxx-v9rj-vpvg
  • GO-2026-5946 CVE-2026-52831 GHSA-v5px-423j-pf7p
  • GO-2026-5947 CVE-2026-53649 GHSA-xqhv-chqm-fhcc
  • GO-2026-5948 CVE-2026-50554 GHSA-588f-fvcv-xhvf
  • GO-2026-5949 CVE-2026-50553 GHSA-rqrh-8wpv-x7hh
  • GO-2026-5950 CVE-2026-53602 GHSA-339v-266x-79xr
  • GO-2026-5951 CVE-2026-10219 GHSA-6jm8-4fhr-5w64
  • GO-2026-5952 CVE-2026-49834 GHSA-9vcr-p3rj-q5q6
  • GO-2026-5953 CVE-2026-9094 GHSA-c9w5-qp6m-m395
  • GO-2026-5956 CVE-2026-55252 GHSA-h5g6-xmh4-hc37
  • GO-2026-5957 CVE-2026-54158 GHSA-5xfx-xj4h-5p7r
  • GO-2026-5958 CVE-2026-54068 GHSA-gcm7-57gf-953c
  • GO-2026-5959 CVE-2026-54072 GHSA-h29v-hj44-q8cv
  • GO-2026-5961 CVE-2026-54069 GHSA-hvr9-72v2-fff3
  • GO-2026-5962 CVE-2026-54088 GHSA-m93h-4hw7-5qcm
  • GO-2026-5963 CVE-2026-54067 GHSA-mvjr-vv3c-w4qv
  • GO-2026-5964 CVE-2026-54066 GHSA-p4m3-mgmm-c664
  • GO-2026-5965 CVE-2026-54070 GHSA-w7cg-whh7-xp28
  • GO-2026-5966 CVE-2026-54089 GHSA-xqp3-jq6g-x3qm
  • GO-2026-5967 CVE-2026-50551 GHSA-56mp-4f3v-fgj2
  • GO-2026-5968 CVE-2026-54174 GHSA-fpg8-7664-jc5q
  • GO-2026-5969 GHSA-g936-7jqj-mwv8
  • GO-2026-5970 CVE-2026-56852
  • GO-2026-5973 CVE-2026-54250 GHSA-jxr7-mqhw-9p98
  • GO-2026-5974 CVE-2026-44300 GHSA-wmj8-9953-vff5
  • GO-2026-5975 CVE-2026-50018 GHSA-42j2-w334-qxw7
  • GO-2026-5976 CVE-2026-50141 GHSA-g7mm-9vx7-jm7h
  • GO-2026-5977 CVE-2026-50013 GHSA-qrh4-p6v4-mrfg
  • GO-2026-5978 CVE-2026-50125 GHSA-qw5r-ppcg-f8rj
  • GO-2026-5979 CVE-2026-50006 GHSA-xrcf-6jh3-ggvx
  • GO-2026-5980 CVE-2026-50158 GHSA-2c7f-fxww-6w6c
  • GO-2026-5981 GHSA-mqxv-9rm6-w8qc
  • GO-2026-5982 GHSA-pqg7-v6wh-3pfp
  • GO-2026-5984 CVE-2026-53604 GHSA-2p2f-px33-4vv5
  • GO-2026-5985 GHSA-7rx3-5wx3-5v76
  • GO-2026-5986 CVE-2026-61699 GHSA-cm26-5974-52h8
  • GO-2026-5987 CVE-2026-55513 GHSA-g4x6-jcvr-9m3g
  • GO-2026-5988 CVE-2026-54628 GHSA-hwrq-8wxh-q4xv
  • GO-2026-5989 CVE-2026-55512 GHSA-m3cx-mwpg-32jg
  • GO-2026-5990 CVE-2026-54629 GHSA-mf78-3rpf-r784
  • GO-2026-5991 CVE-2026-53603 GHSA-q4vm-pq3q-8wgq
  • GO-2026-5992 CVE-2026-61549 GHSA-qf34-295c-26v8
  • GO-2026-5996 CVE-2026-54450 GHSA-pph6-vfjv-vpjw
  • GO-2026-5997 CVE-2026-54452 GHSA-xgch-x3mx-cm3c
  • GO-2026-5998 CVE-2026-54495 GHSA-398h-7f66-3h4p
  • GO-2026-5999 CVE-2026-10814 GHSA-jh6h-v6mp-h22v
  • GO-2026-6002 CVE-2026-58196 GHSA-pr64-jmmf-jp54
  • GO-2026-6003 CVE-2026-53714 GHSA-22xc-xg2r-9j7v
  • GO-2026-6004 CVE-2026-52833 GHSA-3v79-m2cg-89ww
  • GO-2026-6005 CVE-2026-53715 GHSA-8fv2-88gg-hm7q
  • GO-2026-6006 CVE-2026-53716 GHSA-cxpq-8v7q-cg56 *…
Record
openSUSE-SU-2026:21483-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21793-1 No score

Security update for hauler

This update for hauler fixes the following issues:

Changes in hauler:

  • update to 2.1.0 (bsc#1265425, CVE-2026-41888):

    • v2.1.0 is a minor release built on the containerd- native foundation laid down in v2.0.0. The headline is that hauler store sync and hauler store add are now fully concurrent, with signature verification pinned to digests and running in parallel too. Alongside that, this release adds an audit trail, a store integrity checker, store-to-manifest generation, private/insecure registry support across every pull path, and a set of fixes for containerd imports, chunked hauls, and Docker Hub reference handling.
    • Notable dependency bumps: Go → 1.26.6; containerd/v2 → 2.3.4; sigstore/cosign/v3 → 3.1.3; sigstore/sigstore → 1.10.9; go-containerregistry → 0.22.0; helm/v4 → 4.2.4; k8s.io libs (apimachinery, api, client-go) → 0.37.0; logrus → 1.10.2; docker/go-metrics → 0.1.0; sigstore/rekor → 1.5.4 (CVE resolution); plus x/mod and go-isatty.

  • update to 2.0.3 (bsc#1276124, CVE-2026-72817,CVE-2026-72815,CVE-2026-72816):

    • Bump k8s.io/apimachinery from 0.36.2 to 0.36.3 (backport #688)
    • Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 in the go_modules group across 1 directory (backport #691)
    • fix for homebrew macOS binary quarantine (backport #690)
    • fix: process Helm deps before --add-images discovery (backport #703)
    • update hauler store remove to handle registry reference as part of string (backport #705)
    • fixed vuln for golang grpc
Record
openSUSE-SU-2026:21793-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21816-1 No score

Security update for hauler

This update for hauler fixes the following issues:

Changes in hauler:

Update to 2.1.0 (bsc#1265425, CVE-2026-41888, bsc#1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662, ).

Record
openSUSE-SU-2026:21816-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21841-1 No score

Security update for hauler

This update for hauler fixes the following issues:

Changes in hauler:

  • update vendor.tar to fix:

    • bsc#1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: hauler: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library

  • update vendor.tar to fix:

    • bsc#1279416, CVE-2026-84304
    • bsc#1279296, CVE-2026-84303
    • bsc#1278934, CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers

Update to 2.1.0 (bsc#1265425, CVE-2026-41888).

Record
openSUSE-SU-2026:21841-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21983-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
  • CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939).
  • CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935).
  • CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
  • CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
  • CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).
  • CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).
  • CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
  • CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
  • CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).
  • CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
  • CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
  • CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).
Record
openSUSE-SU-2026:21983-1
Updated
2026-11-02
OSVSUSE-SU-2026:2049-1 No score

Security update for helm

This update for helm fixes the following issues

Security issues:

  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
  • CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).

Non security issue:

  • Fix packages for %suse_version bump (jsc#PED-15794).
  • Update to version 3.21.0
Record
SUSE-SU-2026:2049-1
Updated
2026-11-02
OSVSUSE-SU-2026:21881-1 No score

Security update for helm

This update for helm fixes the following issues

  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
  • CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).

Changes for helm:

  • Update to version 3.21.0.
Record
SUSE-SU-2026:21881-1
Updated
2026-11-02
OSVSUSE-SU-2026:21915-1 No score

Security update for helm

This update for helm fixes the following issues

  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
  • CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).

Changes for helm:

  • Update to version 3.21.0.
Record
SUSE-SU-2026:21915-1
Updated
2026-11-02
OSVSUSE-SU-2026:21952-1 No score

Security update for helm

This update for helm fixes the following issues

Security issues:

  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
  • CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).

Non security issue:

  • Update to version 3.21.0.
  • Fix packages for %suse_version bump (jsc#PED-15794)
Record
SUSE-SU-2026:21952-1
Updated
2026-11-02
OSVSUSE-SU-2026:22001-1 No score

Security update for helm

This update for helm fixes the following issues

Security issues:

  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
  • CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).

Non security issue:

  • Update to version 3.21.0.
  • Fix packages for %suse_version bump (jsc#PED-15794)
Record
SUSE-SU-2026:22001-1
Updated
2026-11-02
OSVSUSE-SU-2026:22159-1 No score

Security update for distribution

This update for distribution fixes the following issues

  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265788).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266629).
  • CVE-2026-41888: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265429).
  • CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266049).
  • CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266049).
  • CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266049).
  • CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266049).
  • CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266049).
  • CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266049).
  • CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266049).
  • CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266049).
  • CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266049).
  • CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266049).
  • CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266049).
  • CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266049).
  • CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266049).

Changes:

  • Bounds-check the file basename in PurgeUploads Walk callback
  • Add S3 Express One Zone support to the S3 storage driver
  • Fix tag list endpoint in proxy mode
  • Clamp oversized n query parameter in proxy mode instead of returning 400
  • See the full changelog below for the full list of changes.
  • internal/client/auth/challenge: cleanups and minor refactor
  • build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp from 0.18.0 to 0.19.0 in the go_modules group across 1 directory
  • build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otl ptrace/otlptracehttp from 1.42.0 to 1.43.0 in the go_modules group across 1 directory
  • build(deps): bump github/codeql-action from 4.34.1 to 4.35.1
  • chore(build): Bump go version to latest
  • refactor: use slices.Backward to simplify the code
  • fix(proxy): fix tag list endpoint in proxy mode
  • Update docker-compose structure in deploying.md
  • build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1
  • build(deps): bump actions/upload-pages-artifact from 4.0.0 to 5.0.0
  • build(deps): bump docker/login-action from 4.0.0 to 4.1.0
  • build(deps): bump docker/bake-action from 7.0.0 to 7.1.0
  • fix(proxy): clamp oversized n query param instead of
  • feat(s3): add express zone one support to S3 driver
  • fix(storage): bounds-check the file basename in PurgeUploads Walk callback
  • chore(release): prepare for v3.1.1 release
Record
SUSE-SU-2026:22159-1
Updated
2026-11-02
OSVSUSE-SU-2026:23973-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
  • CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939).
  • CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935).
  • CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
  • CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
  • CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).
  • CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).
  • CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
  • CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
  • CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).
  • CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
  • CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
  • CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).
Record
SUSE-SU-2026:23973-1
Updated
2026-11-02
OSVSUSE-SU-2026:23984-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
  • CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939).
  • CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935).
  • CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
  • CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
  • CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).
  • CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).
  • CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
  • CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
  • CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).
  • CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
  • CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
  • CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).
Record
SUSE-SU-2026:23984-1
Updated
2026-11-02
OSVSUSE-SU-2026:24282-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
  • CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939).
  • CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935).
  • CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
  • CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
  • CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1281426).
  • CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
  • CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
  • CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283642).
  • CVE-2026-81870: OpenTelemetry-Go: Information disclosure via exporter (bsc#1284104).
  • CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
  • CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
  • CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).

Changes for helm:

  • update to 4.3.0:
  • feat: Add duration functions
  • feat(engine): add debug logging when lookup returns empty
  • feat: add ownership verification before deleting resources
  • feat: honor SOURCE_DATE_EPOCH for chart archives
  • feat(rollback): add --description flag to provide rollback reason
  • fix (internal/plugin): remove zero-width spaces from plugin name comment
  • fix(loader): do not drop values files ending at a 4096-byte boundary
  • fix(chart): normalize StampModTimes timestamp to UTC/truncate
  • Chart.lock reproducibility test
  • fix(provenance): support GnuPG keybox (pubring.kbx) keyrings
  • fix(template): regression - route registry messages to stderr in template and show
  • refactor: lower resync period from one hour to 3 minutes
  • perf: enable concurrent status computation to prevent multi-minute delays
  • fix: Improve error reporting for helm template --debug with --show-only- #31185
  • fix: fetch logs from all containers in test pods- #32099
  • fix(provenance): check error return in Digest and encodeRelease- #32136
  • fix panic on repeated IsReachable calls- #32184
  • fix: set [pull,push] scope when helm push to a registry(use token auth) - v4- #31211
  • Fix missing conflict retry with server-side apply- #32088
  • Properly format the extra field in gzipped…
Record
SUSE-SU-2026:24282-1
Updated
2026-11-02
OSVSUSE-SU-2026:4212-1 No score

Security update for distribution

This update for distribution fixes the following issues:

Security issues fixed:

  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260283).
  • CVE-2026-33540: information disclosure via improper validation of authentication realm URL (bsc#1261793).
  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265788).
  • CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262951).
  • CVE-2026-35172: information disclosure via stale references after content deletion (bsc#1262096).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266629).
  • CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831, CVE-2026-39832,CVE-2026-39833,CVE-2026-39834,CVE-2026-39835,CVE-2026-42508, CVE-2026-46595,CVE-2026-46597,CVE-2026-46598: golang.org/x/crypto/ssh: multiple issues (bsc#1268884).
  • CVE-2026-41888: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265429).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272132).

Changes for distribution:

Update to 3.1.1:

  • Bounds-check the file basename in PurgeUploads Walk callback
  • Add S3 Express One Zone support to the S3 storage driver
  • Fix tag list endpoint in proxy mode
  • Clamp oversized n query parameter in proxy mode instead of returning 400
  • See the full changelog below for the full list of changes.
  • internal/client/auth/challenge: cleanups and minor refactor
  • build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp from 0.18.0 to 0.19.0 in the go_modules group across 1 directory
  • build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otl ptrace/otlptracehttp from 1.42.0 to 1.43.0 in the go_modules group across 1 directory
  • build(deps): bump github/codeql-action from 4.34.1 to 4.35.1
  • chore(build): Bump go version to latest
  • refactor: use slices.Backward to simplify the code
  • fix(proxy): fix tag list endpoint in proxy mode
  • Update docker-compose structure in deploying.md
  • build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1
  • build(deps): bump actions/upload-pages-artifact from 4.0.0 to 5.0.0
  • build(deps): bump docker/login-action from 4.0.0 to 4.1.0
  • build(deps): bump docker/bake-action from 7.0.0 to 7.1.0
  • fix(proxy): clamp oversized n query param instead of
  • feat(s3): add express zone one support to S3 driver
  • fix(storage): bounds-check the file basename in PurgeUploads Walk callback
  • chore(release): prepare for v3.1.1 release
  • Adds support for tag pagination
  • Fixes default credentials in Azure storage provider
  • Drops support for go1.23 and go1.24 and updates to go1.25
  • docs: Update to refer to new image tag v3
  • Fix default_credentials in azure storage provider
  • chore: make function comment match function name
  • build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 in the go_modules group across 1 directory
  • fix: implement JWK thumbprint for Ed25519 public keys
  • fix: Annotate code block from validation.indexes configuration docs
  • feat: extract redis config to separate struct
  • Fix: resolve issue #4478 by using a temporary file for non- append writes
  • build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2
  • docs: Add note about OTEL_TRACES_EXPORTER
  • fix: set OTEL traces to disabled by default
  • Fix markdown syntax for OTEL traces link in docs
  • Switch UUIDs to UUIDv7
  • refactor: replace map iteration with maps.Copy/Clone
  • s3-aws: fix build for 386
  • docs: Add OpenTelemetry links to quickstart docs
  • Fix S3 driver loglevel param
  • Fixed data race in TestSchedule test
  • Fixes #4683 - uses X/Y instead of Gx/Gy for thumbprint of ecdsa keys *…
Record
SUSE-SU-2026:4212-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/distribution/distribution/v3
Go
 before 3.1.1
3.1.1
github.com/distribution/distribution
Go
 through 2.8.3 None known
distribution
Bitnami
 before 3.1.1
3.1.1
docker-registry
Debian:12
 All versions, plus listed versions
2.8.2+ds1-12.8.3+ds1-12.8.3+ds1-22.8.3+ds1-3
 None known
docker-registry
Debian:13
 All versions, plus listed versions
2.8.3+ds1-22.8.3+ds1-3
 None known
docker-registry
Debian:14
 All versions, plus listed versions
2.8.3+ds1-22.8.3+ds1-3
 None known
github.com/distribution/distribution
Go
 All versions None known
helm
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 3.21.0-160000.1.1
3.21.0-160000.1.1
helm
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 3.21.0-160000.1.1
3.21.0-160000.1.1
distribution
SUSE:Linux Enterprise Server 16.0
From an advisory covering 16 CVEs
 before 3.1.1-160000.1.1
3.1.1-160000.1.1
Show 34 moreShow less
Affected packages
PackageAffectedFixed
distribution
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 16 CVEs
 before 3.1.1-160000.1.1
3.1.1-160000.1.1
helm
SUSE:Linux Micro 6.2
From an advisory covering 18 CVEs
 before 4.3.0-160000.1.1
4.3.0-160000.1.1
helm
SUSE:Linux Enterprise Server 16.0
From an advisory covering 18 CVEs
 before 4.3.0-160000.1.1
4.3.0-160000.1.1
helm
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 18 CVEs
 before 4.3.0-160000.1.1
4.3.0-160000.1.1
helm
SUSE:Linux Micro 6.1
From an advisory covering 20 CVEs
 before 4.3.0-slfo.1.1_1.1
4.3.0-slfo.1.1_1.1
distribution
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
distribution
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 21 CVEs
 before 3.1.1-150400.9.41.1
3.1.1-150400.9.41.1
docker-registry
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.1.1~ds1-42.1.1~ds1-4ubuntu12.3.0~ds1-12.3.0~ds1-1ubuntu0.1~esm1
 None known
docker-registry
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.6.2~ds1-12.6.2~ds1-1ubuntu0.1~esm1
 None known
docker-registry
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.6.2~ds1-22.7.1~ds1-22.7.1~ds1-32.7.1~ds1-42.7.1+ds2-5
Show 4 moreShow less
2.7.1+ds2-72.7.1+ds2-7ubuntu0.12.7.1+ds2-7ubuntu0.22.7.1+ds2-7ubuntu0.3
 None known
docker-registry
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.7.1+ds2-7build22.8.0+ds1-42.8.0+ds1-4ubuntu0.1~esm12.8.0+ds1-4ubuntu0.1~esm22.8.0+ds1-4ubuntu0.1~esm3
 None known
docker-registry
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.8.2+ds1-1build12.8.2+ds1-1ubuntu0.24.04.12.8.2+ds1-1ubuntu0.24.04.22.8.2+ds1-1ubuntu0.24.04.3
 None known
docker-registry
Ubuntu:25.10
 All versions, plus listed versions
2.8.3+ds1-2
 None known
docker-registry
Ubuntu:26.10
 All versions, plus listed versions
2.8.3+ds1-2build12.8.3+ds1-3
 None known
docker-registry
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
2.8.3+ds1-22.8.3+ds1-2build12.8.3+ds1-2ubuntu0.26.04.1~esm1
 None known
distribution
openSUSE:Tumbleweed
 before 3.1.1-1.1
3.1.1-1.1
helm
openSUSE:Tumbleweed
 before 4.2.0-1.1
4.2.0-1.1
helm3
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 3.21.0-1.1
3.21.0-1.1
hauler
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 2.0.3-1.1
2.0.3-1.1
distribution
openSUSE:Leap 16.0
From an advisory covering 16 CVEs
 before 3.1.1-160000.1.1
3.1.1-160000.1.1
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 1734 CVEs
 before 0.0.20260723T184607-160000.1.1
0.0.20260723T184607-160000.1.1
hauler
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 2.1.0-bp160.1.1
2.1.0-bp160.1.1
hauler
openSUSE:Leap 16.0
From an advisory covering 4 CVEs
 before 2.1.0-bp160.2.1
2.1.0-bp160.2.1
hauler
openSUSE:Leap 16.0
From an advisory covering 7 CVEs
 before 2.1.0-bp160.3.1
2.1.0-bp160.3.1
helm
openSUSE:Leap 16.0
From an advisory covering 18 CVEs
 before 4.3.0-160000.1.1
4.3.0-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-41888 is a medium vulnerability (CVSS 6.3) in Distribution, published May 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 22nd percentile. Fixed in github.com/distribution/distribution/v3 3.1.1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 1,615 references and the rest of 3 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open