Vulnerability in Theupdateframework Go-Tuf
CVE-2026-23991
go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available.
EPSS: 0.005 (41.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Theupdateframework Go-tuf — versions >= 2.0.0, < 2.3.1
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2026-23991?
- CVE-2026-23991 is a medium-severity vulnerability in Theupdateframework Go-Tuf, classified under Reachable Assertion. CVSS score: 5.9/10. Published 2026-01-22.
- How severe is CVE-2026-23991?
- Medium severity. CVSS v3 base score is 5.9 out of 10.