CVE-2026-35172

The record

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again. This vulnerability is fixed in 3.1.0.

Affected packages

Related vulnerabilities

• CVE-2026-33540 Distribution is a toolkit to pack, ship, store, and deliver container content. Also affects envoy-gateway-egctl
• CVE-2026-26958 filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with… Also affects envoy-gateway-egctl
• CVE-2025-64329 containerd CRI server: Host memory exhaustion through Attach goroutine leak Also affects envoy-gateway-egctl
• CVE-2024-25621 containerd affected by a local privilege escalation via wide permissions on CRI directory Also affects envoy-gateway-egctl
• CVE-2025-58058 xz is a pure golang package for reading and writing xz-compressed files. Also affects envoy-gateway-egctl
• CVE-2025-58190 The html.Parse function in golang.org/x/net/html has an infinite parsing loop when… Also affects gitness
• CVE-2025-47911 The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when… Also affects gitness
• CVE-2024-6886 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site… Also affects gitness