Theupdateframework Go-Tuf
5 CVEs affecting Theupdateframework Go-Tuf. Latest disclosed: 2026-01-27. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-29173 | High | 8.0 | 2022-05-05 | go-tuf is a Go implementation of The Update Framework (TUF). go-tuf does not correctly implement the client workflow for updating the metadata files for roles… |
CVE-2026-23992 | Medium | 5.9 | 2026-01-22 | go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repositor… |
CVE-2026-23991 | Medium | 5.9 | 2026-01-22 | go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors… |
CVE-2026-24686 | Medium | 4.7 | 2026-01-27 | go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map file repository name string (`repoName`) as a filesys… |
CVE-2024-47534 | | 2024-10-01 | go-tuf is a Go implementation of The Update Framework (TUF). The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A"… |