CVE-2026-35172highCWE-284CWE-524

CVE-2026-35172: falha de alta gravidade em distribution

Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar distribution+ Monitorar docker-registry

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.5%
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again. This vulnerability is fixed in 3.1.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
distribution · distribution
CVEs relacionadas — distribution

No mesmo produto, das mais perigosas para as menos.

CVE-2025-24976MEDIUMDistribution's token authentication allows attacker to inject an untrusted signing key in a JWTEPSS 0.4%CVE-2026-41888MEDIUMDistribution: Tag deletion bypasses `storage.delete.enabled` configurationEPSS 0.3%CVE-2026-33540HIGHDistribution affected by pull-through cache credential exfiltration via www-authenticate bearer realmEPSS 0.3%CVE-2026-85747MEDIUMDistribution: Client `manifests.Get()` does not verify returned content against requested digestEPSS 0.2%