Vulnerability · Published Jan 22, 2026 · Assigned by GitHub_M
CVE-2026-23991go-tuf affected by client DoS via malformed server response
Medium 5.9
In plain English
A medium-severity security flaw in go-tuf from theupdateframework. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | golang-github-theupdateframework-go-tuf | no fix listed | DEBIAN-CVE-2026-23991 |
| Debian:14 | golang-github-theupdateframework-go-tuf | 2.4.1+0.7.0-1 | DEBIAN-CVE-2026-23991 |
| Go | github.com/theupdateframework/go-tuf/v2 | 2.3.1 | GHSA-846p-jg2w-w324 |
| Go | github.com/theupdateframework/go-tuf/v2 | 2.3.1 | GO-2026-4348 |
| Ubuntu:24.04:LTS | golang-github-theupdateframework-go-tuf | no fix listed | UBUNTU-CVE-2026-23991 |
| Ubuntu:25.10 | golang-github-theupdateframework-go-tuf | no fix listed | UBUNTU-CVE-2026-23991 |
| Ubuntu:26.04:LTS | golang-github-theupdateframework-go-tuf | no fix listed | UBUNTU-CVE-2026-23991 |
| Ubuntu:26.10 | golang-github-theupdateframework-go-tuf | no fix listed | UBUNTU-CVE-2026-23991 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| theupdateframework | go-tuf | >= 2.0.0, < 2.3.1 |
Weakness: CWE-617, CWE-754 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H