PT-2026-3903 · Go-Tuf · Go-Tuf

1Seal · Published 2026-01-19 · Updated 2026-03-03 · CVE-2026-23991

Positive Technologies · (AI Summary)

CVSS v3.1

7.5

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions go-tuf versions 2.0.0 through 2.3.0

Description go-tuf, a Go implementation of The Update Framework (TUF), is susceptible to a denial of service. When processing TUF metadata, versions prior to 2.3.1 may panic if invalid JSON is received from the repository or its mirrors. This occurs before signature validation, allowing a compromised repository or mirror to disrupt client operations without requiring signing key access.

Recommendations Update to version 2.3.1 or later.

Exploit

Fix

DoS

Improper Check for Exceptional Conditions

Assertion Failure

Weakness Enumeration

CWE-754

CWE-617

Related Identifiers

BDU:2026-01060

CVE-2026-23991

GHSA-846P-JG2W-W324

GO-2026-4348

SUSE-SU-2026:0757-1

SUSE-SU-2026:0777-1

Affected Products

Go-Tuf

References · 140

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23991.json · Exploit
• https://github.com/theupdateframework/go-tuf/commit/73345ab6b0eb7e59d525dac17a428f043074cef6 · Patch
• https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-846p-jg2w-w324 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23991 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23991 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-23991 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4348 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-846p-jg2w-w324 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01060 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23991 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23991 · Security Note
• https://ubuntu.com/security/CVE-2026-23991 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0777-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23991 · Vendor Advisory