CVEvulnerability

CVE-2025-2886

5.7 MEDIUM Published 2025-03-27 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2025-03-27
Last modified
2026-06-17
Assigner
ff89ba41-3aa1-4d27-914a-91399e9639e5
CVSS 4.0 (ff89ba41-3aa1-4d27-914a-91399e9639e5)
5.7 MEDIUM — CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
4.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
Weaknesses
CWE-670

Description

Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a terminating delegation. This could cause the client to fetch a target from an incorrect source, altering the target contents. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Affected configurations

• amazon tough (< 0.20.0)

Related

Weakness · CWE (1)

  • CWE-670 Always-Incorrect Control Flow Implementation weakness

References