go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-846p-jg2w-w324 | go-tuf affected by client DoS via malformed server response |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 22 Jan 2026 11:45:00 +0900
| Type | Values Removed | Values Added |
|---|---|---|
| Description | go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available. | |
| Title | go-tuf affected by client DoS via malformed server response | |
| Weaknesses | CWE-617 CWE-754 |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-01-22T02:17:50.311Z
Reserved: 2026-01-19T18:49:20.657Z
Link: CVE-2026-23991
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-01-22T03:15:47.317
Modified: 2026-01-22T03:15:47.317
Link: CVE-2026-23991
Redhat
No data.
OpenCVE Enrichment
No data.