GO-2026-4942

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-4942

Import Source

https://vuln.go.dev/ID/GO-2026-4942.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-4942

Aliases

Published

2026-08-18T18:05:09Z

Modified

2026-08-18T21:40:42.934860937Z

Summary

Stale blob descriptor cache invalidation in github.com/distribution/distribution

Details

In github.com/distribution/distribution and github.com/distribution/distribution/v3 before 3.1.0, when storage.cache.blobdescriptor is configured with redis and storage.delete.enabled is true, deleting a blob in one repository clears the shared digest descriptor in Redis but leaves stale repository-scoped membership behind. If another repository subsequently requests or stats the same digest, the shared descriptor is repopulated and the deleted blob becomes accessible again in the first repository.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-4942"
}

References

Credits

- Oleh Konko (GitHub: 1seal)

Affected packages

Go / github.com/distribution/distribution

Package

Name: github.com/distribution/distribution; View open source insights on deps.dev
Purl: pkg:golang/github.com/distribution/distribution

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/distribution/distribution/registry/storage/cache/redis",
            "symbols": [
                "repositoryScopedRedisBlobDescriptorService.Clear"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-4942.json"

Go / github.com/distribution/distribution/v3

Package

Name: github.com/distribution/distribution/v3; View open source insights on deps.dev
Purl: pkg:golang/github.com/distribution/distribution/v3

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.1.0

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/distribution/distribution/v3/registry/storage/cache/redis",
            "symbols": [
                "repositoryScopedRedisBlobDescriptorService.Clear"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-4942.json"