{"id":"GO-2026-4942","summary":"Stale blob descriptor cache invalidation in github.com/distribution/distribution","details":"In github.com/distribution/distribution and github.com/distribution/distribution/v3 before 3.1.0, when storage.cache.blobdescriptor is configured with redis and storage.delete.enabled is true, deleting a blob in one repository clears the shared digest descriptor in Redis but leaves stale repository-scoped membership behind. If another repository subsequently requests or stats the same digest, the shared descriptor is repopulated and the deleted blob becomes accessible again in the first repository.","aliases":["BIT-distribution-2026-35172","CVE-2026-35172","GHSA-f2g3-hh2r-cwgc"],"modified":"2026-08-18T21:41:24.913146406Z","published":"2026-08-18T18:05:09Z","database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-4942","review_status":"REVIEWED"},"references":[{"type":"ADVISORY","url":"https://github.com/distribution/distribution/security/advisories/GHSA-f2g3-hh2r-cwgc"},{"type":"FIX","url":"https://github.com/distribution/distribution/commit/078b0783f239b4115d1a979e66f08832084e9d1d"},{"type":"REPORT","url":"https://github.com/golang/vulndb/issues/4942"}],"affected":[{"package":{"name":"github.com/distribution/distribution","ecosystem":"Go","purl":"pkg:golang/github.com/distribution/distribution"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"ecosystem_specific":{"imports":[{"symbols":["repositoryScopedRedisBlobDescriptorService.Clear"],"path":"github.com/distribution/distribution/registry/storage/cache/redis"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-4942.json"}},{"package":{"name":"github.com/distribution/distribution/v3","ecosystem":"Go","purl":"pkg:golang/github.com/distribution/distribution/v3"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.1.0"}]}],"ecosystem_specific":{"imports":[{"symbols":["repositoryScopedRedisBlobDescriptorService.Clear"],"path":"github.com/distribution/distribution/v3/registry/storage/cache/redis"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-4942.json"}}],"schema_version":"1.9.0","credits":[{"name":"Oleh Konko (GitHub: 1seal)"}]}