docker-registry: Distribution is a toolkit to pack, ship, store, and deliver container content
CVE-2026-35172 is fixed in 3 products on 1 platform, first by DEBIAN-CVE-2026-35172, released April 6, 2026. It is not reported as exploited. Patch Radar priority: High.
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again. This vulnerability is fixed in 3.1.0.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| distribution · sles 15.6 | 3.1.1-150400.9.41.1 | SUSE-SU-2026:4212-1 | Sep 16, 2026 |
| distribution · sles 15.7 | 3.1.1-150400.9.41.1 | SUSE-SU-2026:4212-1 | Sep 16, 2026 |
| docker-registry · Debian 14 | 2.8.3+ds1-3 | DEBIAN-CVE-2026-35172 | Apr 6, 2026 |
| govulncheck-vulndb · opensuse-leap 16.0 | 0.0.20260827T195228-160000.1.1 | OPENSUSE-SU-2026:21761-1 | Sep 4, 2026 |
| govulncheck-vulndb · sles 16.0 | 0.0.20260827T195228-160000.1.1 | SUSE-SU-2026:23625-1 | Sep 4, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.