Vulnerability GO-2026-5185
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
3 months ago
June 25, 2026 at 06:43 PM UTC
Distribution's tag deletion bypasses `storage.delete.enabled` configuration in github.com/distribution/distribution
v2.0.0-alpha.0+incompatible - v2.8.3+incompatible
v2.0.0-alpha.0+incompatible - v2.8.3+incompatible
Summary
Distribution's tag deletion bypasses `storage.delete.enabled` configuration in github.com/distribution/distribution
Details
Distribution's tag deletion bypasses storage.delete.enabled configuration in github.com/distribution/distribution
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
6 hours ago
Distribution: Client `manifests.Get()` does not verify returned content against requested digest
v3.0.0-alpha.1 - v3.1.1 GHSA-685w-q87j-wqw3
v3.0.0-alpha.1 - v3.1.1 GHSA-685w-q87j-wqw3
Unknown
1 month ago
Stale blob descriptor cache invalidation in github.com/distribution/distribution
v3.0.0-alpha.1 - v3.0.0 GO-2026-4942
v3.0.0-alpha.1 - v3.0.0 GO-2026-4942
Unknown
1 month ago
Stale blob descriptor cache invalidation in github.com/distribution/distribution
v3.0.0-alpha.1 - v3.0.0 GO-2026-4942
v3.0.0-alpha.1 - v3.0.0 GO-2026-4942
Unknown
3 months ago
Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm in github.com/distribution/distribution
v3.0.0-alpha.1 - v3.0.0 GO-2026-5094
v3.0.0-alpha.1 - v3.0.0 GO-2026-5094
Unknown
3 months ago
Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm in github.com/distribution/distribution
v3.0.0-alpha.1 - v3.0.0 GO-2026-5094
v3.0.0-alpha.1 - v3.0.0 GO-2026-5094
Impacted packages
Timeline
Published
3 months ago
June 25, 2026 at 06:43 PM UTC
Fixed (v3.1.1)
5 months ago
May 01, 2026 at 03:28 PM UTC
Last Modified
1 month ago
August 18, 2026 at 11:25 AM UTC