{"cve":"CVE-2026-23991","nvd":{"published":"2026-01-22T03:15:47.317","modified":"2026-06-17T10:22:26.410","status":"Analyzed","description":"go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-617","CWE-754"],"references":["https://github.com/theupdateframework/go-tuf/commit/73345ab6b0eb7e59d525dac17a428f043074cef6","https://github.com/theupdateframework/go-tuf/releases/tag/v2.3.1","https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-846p-jg2w-w324"],"products":["theupdateframework:go-tuf"],"source":"nvd","synced_at":"2026-10-19T22:21:16.563232421+00:00"},"epss":{"cve":"CVE-2026-23991","score":0.00581,"percentile":0.47771,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-846p-jg2w-w324","url":"https://osv.dev/vulnerability/GHSA-846p-jg2w-w324","summary":"go-tuf affected by client DoS via malformed server response","modified":"2026-09-10T03:50:32.759493717Z","packages":[{"ecosystem":"Go","name":"github.com/theupdateframework/go-tuf/v2","purl":"pkg:golang/github.com/theupdateframework/go-tuf/v2","ranges":["<2.3.1"],"fixed":["2.3.1"]}]},{"id":"GO-2026-4348","url":"https://osv.dev/vulnerability/GO-2026-4348","summary":"Client DoS via malformed server response in github.com/theupdateframework/go-tuf","modified":"2026-08-07T08:11:56.365299443Z","packages":[{"ecosystem":"Go","name":"github.com/theupdateframework/go-tuf/v2","purl":"pkg:golang/github.com/theupdateframework/go-tuf/v2","ranges":["<2.3.1"],"fixed":["2.3.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}