CVE-2026-23991

MEDIUM

5.9

Descripcion

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available.

Detalles CVE

Puntuacion CVSS v3.15.9

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Vector de ataqueNETWORK

ComplejidadHIGH

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado1/22/2026

Ultima modificacion2/17/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

theupdateframework:go-tuf

Debilidades (CWE)

CWE-617CWE-754

Referencias

https://github.com/theupdateframework/go-tuf/commit/73345ab6b0eb7e59d525dac17a428f043074cef6(security-advisories@github.com)

https://github.com/theupdateframework/go-tuf/releases/tag/v2.3.1(security-advisories@github.com)

https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-846p-jg2w-w324(security-advisories@github.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.