GO-2026-4942
Stale blob descriptor cache invalidation in github.com/distribution/distribution
Quick fix
GO-2026-4942 — github.com/distribution/distribution/v3: upgrade to the fixed version with the command below.
go get github.com/distribution/distribution/v3@v3.1.0Details
In github.com/distribution/distribution and github.com/distribution/distribution/v3 before 3.1.0, when storage.cache.blobdescriptor is configured with redis and storage.delete.enabled is true, deleting a blob in one repository clears the shared digest descriptor in Redis but leaves stale repository-scoped membership behind. If another repository subsequently requests or stats the same digest, the shared descriptor is repopulated and the deleted blob becomes accessible again in the first repository.
Are you affected?
Enter the version of the package you're using.
Affected packages
0 No fixed version published yet for github.com/distribution/distribution (go modules). Pin to a known-safe version or switch to an alternative.
0 Fixed in: 3.1.0 go get github.com/distribution/distribution/v3@v3.1.0