Denial of Service Vulnerability in Go-TUF by The Update Framework

CVE-2026-23991

What is CVE-2026-23991?

The go-tuf project, which implements The Update Framework (TUF) in Go, has a vulnerability affecting versions 2.0.0 up to 2.3.0. This vulnerability causes a denial of service (DoS) to clients when the TUF repository or its mirrors return invalid TUF metadata JSON. Although the JSON may be technically valid, improper formatting causes the client to panic during the parsing stage, occurring before any signature validation. This flaw allows a compromised repository or mirror to disrupt client operations without requiring access to any signing keys. The issue has been addressed in version 2.3.1, and no workarounds exist.

References