{"schema_version":"1.9.0","id":"GO-2026-4942","published":"2026-08-18T18:05:09Z","modified":"2026-08-18T21:40:42.934860937Z","aliases":["BIT-distribution-2026-35172","CVE-2026-35172","GHSA-f2g3-hh2r-cwgc"],"summary":"Stale blob descriptor cache invalidation in github.com/distribution/distribution","details":"In github.com/distribution/distribution and github.com/distribution/distribution/v3 before 3.1.0, when storage.cache.blobdescriptor is configured with redis and storage.delete.enabled is true, deleting a blob in one repository clears the shared digest descriptor in Redis but leaves stale repository-scoped membership behind. If another repository subsequently requests or stats the same digest, the shared descriptor is repopulated and the deleted blob becomes accessible again in the first repository.","affected":[{"package":{"name":"github.com/distribution/distribution","ecosystem":"Go","purl":"pkg:golang/github.com/distribution/distribution"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/distribution/distribution/registry/storage/cache/redis","symbols":["repositoryScopedRedisBlobDescriptorService.Clear"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-4942.json"}},{"package":{"name":"github.com/distribution/distribution/v3","ecosystem":"Go","purl":"pkg:golang/github.com/distribution/distribution/v3"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.1.0"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/distribution/distribution/v3/registry/storage/cache/redis","symbols":["repositoryScopedRedisBlobDescriptorService.Clear"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-4942.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/distribution/distribution/security/advisories/GHSA-f2g3-hh2r-cwgc"},{"type":"FIX","url":"https://github.com/distribution/distribution/commit/078b0783f239b4115d1a979e66f08832084e9d1d"},{"type":"REPORT","url":"https://github.com/golang/vulndb/issues/4942"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-4942"},"credits":[{"name":"Oleh Konko (GitHub: 1seal)"}]}