CVE-2026-23992: fallo de gravedad media en theupdateframework go-tuf
go-tuf improperly validates the configured threshold for delegations
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.9epss 0.2%
go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Productos afectados
theupdateframework · go-tufCVEs relacionadas — theupdateframework go-tuf
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-23991MEDIUMgo-tuf affected by client DoS via malformed server responseEPSS 0.6%CVE-2022-29173HIGHNo protection against rollback attacks in go-tufEPSS 0.6%CVE-2024-47534HIGHIncorrect delegation lookups can make go-tuf download the wrong artifactEPSS 0.5%CVE-2026-24686MEDIUMgo-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository NamesEPSS 0.2%