CVE-2025-2886CWE-670

Terminating targets role delegations are not respected in tough

Medium · published March 27, 2025

CVSS v4.0
5.7
EPSS
0%
Percentile
25.2
In the wild
Unconfirmed
What it is

Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a terminating delegation. This could cause the client to fetch a target from an incorrect source, altering the target contents. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

The record
Technical detail
CVSS v4.0
5.7 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00332 · 25.2th percentile
Weakness
CWE-670 · Always-Incorrect Control Flow Implementation
Published
2025-03-27T22:22Z
EPSS history
Timeline
  • 27 MAR 22:22Z
    Terminating targets role delegations are not respected in tough
    cvelistv5