CVE-2026-23991
MediumCVSS 5.9Summary
go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to 2.3.1, if the TUF repository (or any mirror) returns invalid TUF metadata JSON (valid JSON but not well-formed TUF metadata), the client panics during parsing, causing denial of service. The panic occurs before signature validation, so a compromised repository/mirror/cache can DoS clients without any signing key.
Risk Assessment
A malicious or compromised TUF repository can cause a panic and unavailability of the client without needing a signing key. This can disrupt the software update process in the organization.
Recommendation
Update go-tuf to version 2.3.1 or later. No known workarounds — updating is required.
Other vulnerabilities in go-tuf
See all- CVE-2026-24686Medium
go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map file repository name string (repoName) as a filesystem path component when selecting the local metadata cache directory. Starting in version 2.0.0 and prior to version 2.4.1, if an application accepts a map file from an untrusted source, an attacker can supply a repoName containing traversal (e.g., ../escaped-repo) and cause go-tuf to create directories and write the root metadata file outside the intended LocalMetadataDir cache base, within the running process's filesystem permissions. Version 2.4.1 contains a patch.
- CVE-2026-23992Medium
go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification of TUF metadata files at rest or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always ensure that TUF metadata roles are configured with a threshold of at least 1.
Original NVD description (English source)
go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS