CVE-2026-23991CWE-617CWE-754

go-tuf affected by client DoS via malformed server response

Medium · published January 22, 2026

CVSS v3.1
5.9
EPSS
1%
Percentile
47.0
In the wild
Unconfirmed
What it is

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00581 · 47.0th percentile
Weaknesses
CWE-617 · Reachable Assertion; CWE-754 · Improper Check for Unusual or Exceptional Conditions
Published
2026-01-22T02:16Z
EPSS history
Timeline
  • 22 JAN 02:16Z
    go-tuf affected by client DoS via malformed server response
    cvelistv5