Homepage

Information Exposure Through Caching The advisory has been revoked - it doesn't affect any version of package openshift4/ose-operator-framework-tools-rhel9  (opens in a new tab)

Threat Intelligence

EPSS
0.46% (37th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL9-OPENSHIFT4OSEOPERATORFRAMEWORKTOOLSRHEL9-15976305
  • published11 Apr 2026
  • disclosed6 Apr 2026
Report a new vulnerability Found a mistake?

Introduced: 6 Apr 2026

CVE-2026-35172  (opens in a new tab)
CWE-524  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream openshift4/ose-operator-framework-tools-rhel9 package and not the openshift4/ose-operator-framework-tools-rhel9 package as distributed by RHEL.

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again. This vulnerability is fixed in 3.1.0.