CVE-2026-23991

{"id": "CVE-2026-23991", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23991", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-22T15:24:15.603757Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "theupdateframework", "product": "go-tuf", "versions": [{"status": "affected", "version": ">= 2.0.0, < 2.3.1"}]}]}], "published": "2026-01-22T03:15:47.317", "references": [{"url": "https://github.com/theupdateframework/go-tuf/commit/73345ab6b0eb7e59d525dac17a428f043074cef6", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/theupdateframework/go-tuf/releases/tag/v2.3.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-846p-jg2w-w324", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-617"}, {"lang": "en", "value": "CWE-754"}]}], "descriptions": [{"lang": "en", "value": "go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available."}, {"lang": "es", "value": "go-tuf es una implementaci\u00f3n en Go de The Update Framework (TUF). A partir de la versi\u00f3n 2.0.0 y antes de la versi\u00f3n 2.3.1, si el repositorio TUF (o cualquiera de sus espejos) devuelve JSON de metadatos TUF no v\u00e1lido (JSON v\u00e1lido pero metadatos TUF no bien formados), el cliente entrar\u00e1 en p\u00e1nico durante el an\u00e1lisis, causando una denegaci\u00f3n de servicio. El p\u00e1nico ocurre antes de que se valide cualquier firma. Esto significa que un repositorio/espejo/cach\u00e9 comprometido puede DoS a los clientes sin tener acceso a ninguna clave de firma. La versi\u00f3n 2.3.1 soluciona el problema. No hay soluciones alternativas conocidas disponibles."}], "lastModified": "2026-06-17T10:22:26.410", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:theupdateframework:go-tuf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6442E623-C25E-418E-A418-324F815885AF", "versionEndExcluding": "2.3.1", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}