Client Configuration Vulnerability in Tough by AWS

CVE-2025-2886

What is CVE-2025-2886?

A validation issue in the Tough library allows a client to continue fetching data from a specified delegation list, even after reaching a termination point. This misconfiguration can lead to the retrieval of target contents from incorrect sources, potentially compromising the integrity of data. It is crucial for users of Tough to upgrade to version 0.20.0 or later and ensure that any custom or forked versions include the necessary patches to mitigate this vulnerability.

References