{
  "cveId": "CVE-2026-41888",
  "url": "https://patchblox.com/security/cve/CVE-2026-41888",
  "summary": "CVE-2026-41888 is fixed in 4 products on 1 platform, first by OPENSUSE-SU-2026:21084-1, released June 18, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "distribution: This update for distribution fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-33186: google.golang.org...",
  "description": "This update for distribution fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-\n  header (bsc#1260283).\n- CVE-2026-33540: information disclosure via improper validation of authentication realm URL (bsc#1261793).\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n  (bsc#1265788).\n- CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of\n  service (bsc#1262951).\n- CVE-2026-35172: information disclosure via stale references after content deletion (bsc#1262096).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266629).\n- CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,\n  CVE-2026-39832,CVE-2026-39833,CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,\n  CVE-2026-46595,CVE-2026-46597,CVE-2026-46598: golang.org/x/crypto/ssh: multiple issues (bsc#1268884).\n- CVE-2026-41888: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265429).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272132).\n\nChanges for distribution:\n\nUpdate to 3.1.1:\n\n * Bounds-check the file basename in PurgeUploads Walk callback\n * Add S3 Express One Zone support to the S3 storage driver\n * Fix tag list endpoint in proxy mode\n * Clamp oversized \u0060n\u0060 query parameter in proxy mode instead of\n returning 400\n * See the full changelog below for the full list of changes.\n * internal/client/auth/challenge: cleanups and minor refactor\n * build(deps): bump\n go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp\n from 0.18.0 to 0.19.0 in the go_modules group across 1\n directory\n * build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otl\n ptrace/otlptracehttp from 1.42.0 to 1.43.0 in the go_modules\n group across 1 directory\n * build(deps): bump github/codeql-action from 4.34.1 to 4.35.1\n * chore(build): Bump go version to latest\n * refactor: use slices.Backward to simplify the code\n * fix(proxy): fix tag list endpoint in proxy mode\n * Update docker-compose structure in deploying.md\n * build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1\n * build(deps): bump actions/upload-pages-artifact from 4.0.0 to\n 5.0.0\n * build(deps): bump docker/login-action from 4.0.0 to 4.1.0\n * build(deps): bump docker/bake-action from 7.0.0 to 7.1.0\n * fix(proxy): clamp oversized n query param instead of\n * feat(s3): add express zone one support to S3 driver\n * fix(storage): bounds-check the file basename in PurgeUploads\n Walk callback\n * chore(release): prepare for v3.1.1 release\n * Adds support for tag pagination\n * Fixes default credentials in Azure storage provider\n * Drops support for go1.23 and go1.24 and updates to go1.25\n * docs: Update to refer to new image tag v3\n * Fix default_credentials in azure storage provider\n * chore: make function comment match function name\n * build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 in\n the go_modules group across 1 directory\n * fix: implement JWK thumbprint for Ed25519 public keys\n * fix: Annotate code block from validation.indexes\n configuration docs\n * feat: extract redis config to separate struct\n * Fix: resolve issue #4478 by using a temporary file for non-\n append writes\n * build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2\n * docs: Add note about \u0060OTEL_TRACES_EXPORTER\u0060\n * fix: set OTEL traces to disabled by default\n * Fix markdown syntax for OTEL traces link in docs\n * Switch UUIDs to UUIDv7\n * refactor: replace map iteration with maps.Copy/Clone\n * s3-aws: fix build for 386\n * docs: Add OpenTelemetry links to quickstart docs\n * Fix S3 driver loglevel param\n * Fixed data race in TestSchedule test\n * Fixes #4683 - uses X/Y instead of Gx/Gy for thumbprint of\n ecdsa keys\n * build(deps): bump actions/checkout from 4 to 5\n * Fix broken link to Docker Hub fair use policy\n * fix(registry/handlers/app): redis CAs\n * build(deps): bump actions/labeler from 5 to 6\n * build(deps): bump actions/setup-go from 5 to 6\n * build(deps): bump actions/upload-pages-artifact from 3 to 4\n * build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3\n * build(deps): bump github/codeql-action from 3.26.5 to 4.30.7\n * build(deps): bump github/codeql-action from 4.30.7 to 4.30.8\n * chore: labeler: add area/client mapping for\n internal/client/**\n * client: add Accept headers to Exists() HEAD\n * feat(registry): Make graceful shutdown test robust\n * fix(registry): Correct log formatting for upstream challenge\n * build(deps): bump github/codeql-action from 4.30.8 to 4.30.9\n * build(deps): bump github/codeql-action from 4.30.9 to 4.31.3\n * refactor: remove redundant variable declarations in for loops\n * \u0027should\u0027 -\u003E \u0027must\u0027 regarding redis eviction policy\n * build(deps): bump actions/checkout from 5 to 6\n * Incorrect warning hint\n * Add return error when list object\n * build(deps): bump actions/checkout from 5.0.1 to 6.0.0\n * build(deps): bump peter-evans/dockerhub-description from 4 to\n 5\n * fix: Logging regression for manifest HEAD requests\n * Add boolean parsing util\n * Expose \u0060useFIPSEndpoint\u0060 for S3\n * Add Cloudfleet Container Registry to adopters\n * fix(ci): Fix broken Azure e2e storage tests\n * BUG: Fix notification filtering to work with actions when\n mediatypes is empty\n * build(deps): bump actions/checkout from 6.0.0 to 6.0.1\n * build(deps): bump actions/upload-artifact from 4.6.2 to 6.0.0\n * build(deps): bump github/codeql-action from 4.31.3 to 4.31.10\n * build(deps): bump github/codeql-action from 4.31.10 to 4.32.2\n * build(deps): bump actions/checkout from 6.0.1 to 6.0.2\n * update golangci-lint to v2.9 and fix linting issues\n * update to go1.25.7, alpine 3.23, xx v1.9.0\n * vendor: github.com/sirupsen/logrus v1.9.4\n * vendor: update golang.org/x/* dependencies\n * vendor: github.com/docker/docker-credential-helpers v0.9.5\n * vendor: github.com/opencontainers/image-spec v1.1.1\n * vendor: github.com/klauspost/compress v1.18.4\n * fix: prefer otel variables over hard coded service name\n * vendor: github.com/spf13/cobra v1.10.2\n * vendor: github.com/bshuster-repo/logrus-logstash-hook v1.1.0\n * fix: sync parent dir to ensure data is reliably stored\n * modernize code\n * vendor: github.com/docker/go-events 605354379745\n * vendor: github.com/go-jose/go-jose/v4 v4.1.3\n * build(deps): bump github/codeql-action from 4.32.2 to 4.32.5\n * build(deps): bump docker/login-action from 3 to 4\n * build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0\n * build(deps): bump docker/setup-buildx-action from 3 to 4\n * build(deps): bump docker/bake-action from 6 to 7\n * build(deps): bump docker/metadata-action from 5 to 6\n * fix: nil-check scheduler in \u0060proxyingRegistry.Close()\u0060\n * fix: set MD5 on GCS writer before first \u0060Write\u0060 call in\n \u0060putContent\u0060\n * docs: pull through cache will pull from remote multiple times\n * Update s3.md regionendpoint option\n * chore(deps): Bump Go to latest 1.25 in CI workflows and\n go.mod\n * fix: correct Ed25519 JWK thumbprint \u0060kty\u0060 from \u0060\u0027OTP\u0027\u0060 to\n \u0060\u0027OKP\u0027\u0060\n * Update vacuum.go\n * Opt: refector tag list pagination support (stage 1)\n * Correctly match environment variables to YAML-inlined structs\n in configuration\n * Enable Redis TLS without client certificates\n * build(deps): bump actions/deploy-pages from 4 to 5\n * build(deps): bump github/codeql-action from 4.32.5 to 4.34.1\n * fix(registry/proxy): use detached context when flushing write\n buffer\n * ci: pin actions and apply zizmor auto-fixes\n * build(deps): bump actions/setup-go from 6.3.0 to 6.4.0\n * build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to\n 4.1.4 in the go_modules group across 1 directory\n * chore(app): warn when partial TLS config is used in Redis\n * feat(registry): enhance authentication checks in htpasswd\n implementation\n * Opt: refactor tag list pagination support\n * build(deps): bump codecov/codecov-action from 5.5.4 to 6.0.0\n * build(deps): bump actions/configure-pages from 5.0.0 to 6.0.0\n * fix(vendor): fix broke vendor validation\n * chore(ci): Prep for v3.1 release\n- Update to version 3.1.0:\n * fix(vendor): fix broke vendpor validation\n * fix redis repo-scoped blob descriptor revocation\n * proxy: bind bearer realms to upstream trust boundary\n- restore directory ownership after last change\n- Move config files in systemd tmpfiles dir for immutable mode\n (jsc#PED-14747)\n * Add distribution-registry.tmpfiles\n * This is the first v3 stable release since \u0060v2.8.3\u0060 which is a\n culmination of years of hard work of the container community\n and registry maintainers!\n * If you are upgrading from \u0060v2.x\u0060 and have never used any of\n the release candidates, please familiarise yourselves with\n the \u0060v2.x\u0060 deprecations properly.\n * oss and swift storage drivers are no longer supported\n * \u0060docker/libtrust\u0060 has been replaced with \u0060go-jose/go-jose\u0060 in\n https://github.com/distribution/distribution/pull/4096\n * \u0060client\u0060 is no longer supported as a standalone package in\n https://github.com/distribution/distribution/pull/4126\n * the default configuration path has changed to\n \u0060/etc/distribution/config.yml\u0060\n * \u0060ManifestBuilder\u0060 interface in 3886\n * \u0060manifest.Versioned\u0060 has been deprecated in favor of\n \u0060oci.Versioned\u0060 in 3887\n * \u0060reference\u0060 package has been moved to\n github.com/distribution/reference in\n https://github.com/distribution/distribution/pull/4063",
  "published": "2026-06-18T14:30:03Z",
  "severity": "",
  "epss": 0.00294,
  "epssPercentile": 0.22159,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "distribution",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "3.1.1-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21084-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21084-1",
      "released": "2026-06-18T14:30:03Z"
    },
    {
      "platform": "linux",
      "product": "distribution",
      "release": "sles 15.6",
      "fixedVersion": "3.1.1-150400.9.41.1",
      "fix": "SUSE-SU-2026:4212-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4212-1",
      "released": "2026-09-16T11:52:48Z"
    },
    {
      "platform": "linux",
      "product": "distribution",
      "release": "sles 15.7",
      "fixedVersion": "3.1.1-150400.9.41.1",
      "fix": "SUSE-SU-2026:4212-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4212-1",
      "released": "2026-09-16T11:52:48Z"
    },
    {
      "platform": "linux",
      "product": "distribution",
      "release": "sles 16.0",
      "fixedVersion": "3.1.1-160000.1.1",
      "fix": "SUSE-SU-2026:22159-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-22159-1",
      "released": "2026-06-18T14:30:18Z"
    },
    {
      "platform": "linux",
      "product": "govulncheck-vulndb",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "0.0.20260723T184607-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21483-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21483-1",
      "released": "2026-07-30T09:09:47Z"
    },
    {
      "platform": "linux",
      "product": "hauler",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "2.1.0-bp160.3.1",
      "fix": "OPENSUSE-SU-2026:21841-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21841-1",
      "released": "2026-09-14T13:24:33Z"
    },
    {
      "platform": "linux",
      "product": "helm",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "4.3.0-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21983-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21983-1",
      "released": "2026-09-30T17:58:26Z"
    },
    {
      "platform": "linux",
      "product": "helm",
      "release": "sles 16.0",
      "fixedVersion": "4.3.0-160000.1.1",
      "fix": "SUSE-SU-2026:23984-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23984-1",
      "released": "2026-09-30T17:49:13Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}