GitHub Advisoryadvisory · Go

GHSA-846p-jg2w-w324 go-tuf affected by client DoS via malformed server response

MEDIUM Published 2026-01-21 Modified 2026-01-22 Official page ↗
Aliases
CVE-2026-23991
Ecosystem
Go
Packages
github.com/theupdateframework/go-tuf/v2
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-617, CWE-754
Reviewed
2026-01-21

Affected packages

• Go github.com/theupdateframework/go-tuf/v2: < 2.3.1 → fixed in 2.3.1

Description

Security Disclosure: Client DoS via malformed server response Summary If the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic _during parsing_, causing a DoS. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Impact Client crashes upon receiving and parsing malformed TUF metadata. This can cause long running services to enter an restart/crash loop. Workarounds None currently. Affected code The `metadata.checkType` function did not properly type assert the (untrusted) input causing it to panic on malformed data.

Related

Alias · CVE (1)

  • CVE-2026-23991 go-tuf is a Go implementation of The Update Framework (TUF). vulnerability

Weakness · CWE (2)

  • CWE-617 Reachable Assertion weakness
  • CWE-754 Improper Check for Unusual or Exceptional Conditions weakness

References