PT-2026-3903 · Go-Tuf · Go-Tuf

1Seal · Published 2026-01-19 · Updated 2026-05-18 · CVE-2026-23991

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions go-tuf versions 2.0.0 through 2.3.0

Description go-tuf, a Go implementation of The Update Framework (TUF), is susceptible to a denial of service. When processing TUF metadata, versions prior to 2.3.1 may panic if invalid JSON is received from the repository or its mirrors. This occurs before signature validation, allowing a compromised repository or mirror to disrupt client operations without requiring signing key access.

Recommendations Update to version 2.3.1 or later.

Exploit

Fix

DoS

Assertion Failure

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-617

CWE-754

Related Identifiers

AZL-75186

BDU:2026-01060

CLEANSTART-2026-BD19566

CLEANSTART-2026-EZ47382

CLEANSTART-2026-NS33477

CLEANSTART-2026-SH14815

CLEANSTART-2026-WN01990

CVE-2026-23991

GHSA-846P-JG2W-W324

GO-2026-4348

OPENSUSE-SU-2026:10235-1

OPENSUSE-SU-2026:20386-1

SUSE-SU-2026:0403-1

SUSE-SU-2026:0757-1

SUSE-SU-2026:0777-1

SUSE-SU-2026:20904-1

Affected Products

Go-Tuf

References · 351

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23991.json · Exploit
• https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-846p-jg2w-w324 · Vendor Advisory
• https://github.com/theupdateframework/go-tuf/commit/73345ab6b0eb7e59d525dac17a428f043074cef6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27139 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-22703 · Security Note
• https://ubuntu.com/security/CVE-2026-23991 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33810 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42499 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42501 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61728 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39826 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-68119 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39823 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39836 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-BD19566 · Vendor Advisory