Skip to content
fr Sign in
7.5 High

CVE-2026-35172 Distribution is a toolkit to pack, ship, store, and deliver container content

Description

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again. This vulnerability is fixed in 3.1.0.

Affected products and versions

Product Affected versions Fixed in
distribution 3.1 earliest → < 3.1.0 3.1.0
Red Hat OpenShift Container Platform 4.12 1781122773 earliest → < 1781122773 1781122773
Red Hat OpenShift Container Platform 4.13 1781123052 earliest → < 1781123052 1781123052
Red Hat OpenShift Container Platform 4.15 1779915499 earliest → < 1779915499 1779915499
Red Hat OpenShift Container Platform 4.16 1780957268 earliest → < 1780957268 1780957268
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat OpenShift Container Platform 4.14 1781833795 earliest → < 1781833795 1781833795
Red Hat Openshift Data Foundation 4.22 1782934284 earliest → < 1782934284 1782934284
Multicluster Engine for Kubernetes Versions not published
Show the other branch
Product Affected versions Fixed in
Red Hat Advanced Cluster Management for Kubernetes 2 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of distribution

The 5 CVEs of distribution →
CVE-2026-85747 Distribution is a toolkit to pack, ship, store, and deliver container content 6.8 Medium CVE-2026-41888 Distribution is a toolkit to pack, ship, store, and deliver container content 6.3 Medium CVE-2026-33540 Distribution is a toolkit to pack, ship, store, and deliver container content 7.5 High CVE-2025-24976 Distribution is a toolkit to pack, ship, store, and deliver container content 6.6 Medium
Track this CVE