CVE-2026-35172
HIGHDistribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation
Title source: cnaDescription
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again. This vulnerability is fixed in 3.1.0.
References (1)
Core 1
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/distribution/distribution/security/advisories/GHSA-f2g3-hh2r-cwgc
Scores
CVSS v3
7.5
EPSS
0.0029
EPSS Percentile
20.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-284
Status
published
Products (3)
distribution/distribution
< 3.1.0 (2 CPE variants)
distribution/distribution
0Go
distribution/distribution
0 - 3.1.0Go
Published
Apr 06, 2026
Tracked Since
Apr 07, 2026