PT-2026-3903 · Go-Tuf · Go-Tuf

1Seal · Publicado 2026-01-19 · Atualizado 2026-05-18 · CVE-2026-23991

Positive Technologies (AI Summary) · Pt

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Nome do Software Vulnerável e Versões Afetadas go-tuf versões 2.0.0 a 2.3.0

Descrição go-tuf, uma implementação em Go do The Update Framework (TUF), está suscetível a uma negação de serviço. Ao processar metadados do TUF, versões anteriores à 2.3.1 podem entrar em pânico se JSON inválido for recebido do repositório ou de seus espelhos. Isso ocorre antes da validação da assinatura, permitindo que um repositório ou espelho comprometido interrompa as operações do cliente sem exigir acesso à chave de assinatura.

Recomendações Atualize para a versão 2.3.1 ou posterior.

Exploit

Correção

DoS

Assertion Failure

Improper Check for Exceptional Conditions

Enumeração de Fraquezas

CWE-617

CWE-754

Identificadores relacionados

AZL-75186

BDU:2026-01060

CLEANSTART-2026-BD19566

CLEANSTART-2026-EZ47382

CLEANSTART-2026-NS33477

CLEANSTART-2026-SH14815

CLEANSTART-2026-WN01990

CVE-2026-23991

GHSA-846P-JG2W-W324

GO-2026-4348

OPENSUSE-SU-2026:10235-1

OPENSUSE-SU-2026:20386-1

SUSE-SU-2026:0403-1

SUSE-SU-2026:0757-1

SUSE-SU-2026:0777-1

SUSE-SU-2026:20904-1

Produtos afetados

Go-Tuf

Referências · 351

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23991.json · Exploit
• https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-846p-jg2w-w324 · Aviso do Fabricante
• https://github.com/theupdateframework/go-tuf/releases/tag/v2.3.1 · Nota
• https://github.com/theupdateframework/go-tuf/commit/73345ab6b0eb7e59d525dac17a428f043074cef6 · Correção
• https://github.com/theupdateframework/go-tuf · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-EZ47382.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SH14815.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-BD19566.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-NS33477.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-WN01990.json · Nota
• https://osv.dev/vulnerability/ghsa-whqx-f9j3-ch6m · Nota
• https://suse.com/security/cve/CVE-2026-0998 · Nota
• https://suse.com/support/update/announcement/2026/suse-su-20260777-1 · Nota
• https://suse.com/security/cve/CVE-2026-0798 · Nota
• https://suse.com/security/cve/CVE-2025-13821 · Nota