CVE-2026-23991

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-23991
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-23991.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-23991
Aliases
Downstream
Published
2026-01-22T02:16:37.294Z
Modified
2026-01-23T04:50:52.501494Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
go-tuf affected by client DoS via malformed server response
Details

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available.

Database specific 
{
    "cwe_ids": [
        "CWE-617",
        "CWE-754"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23991.json"
}
References

Affected packages

Git / github.com/theupdateframework/go-tuf

Affected ranges

Type
GIT
Repo
https://github.com/theupdateframework/go-tuf
Events
Introduced
ecec5d3a09cfa74482f0797fa38b65a2942a655c
Fixed
b38d91fdbc69dfe31fe9230d97dafe527ea854a0

Affected versions

v2.*

v2.0.0
v2.0.1
v2.0.2
v2.1.0
v2.1.1
v2.2.0
v2.3.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-23991.json"