CVE-2026-23991: go-tuf affected by client DoS via malformed server response

Analyzed

AliasesUBUNTU-CVE-2026-23991DEBIAN-CVE-2026-23991CGA-23w7-5c6p-6f8q+513 more

Published 22-01-2026Last modified 22-01-2026

Vulnerability summary

CVE-2026-23991 is a high (CVSS 7.5) Reachable Assertion vulnerability in theupdateframework go-tuf. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 47.8% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

0.58%

0%100%

Low · -0.01 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7 · Related 10

OPENSUSE-SU-2026:10235-1 OPENSUSE-SU-2026:20386-1 OPENSUSE-SU-2026:21483-1 SUSE-SU-2026:0403-1 SUSE-SU-2026:0757-1 SUSE-SU-2026:0777-1+4 more

Timeline

22-01-2026
PublishedVulnerability first disclosed.
22-01-2026
Last modifiedVulnerability information updated.

Description

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available.

CVSS metrics

7 scores · 7 sources · 1 version

v3.17.5

EPSS trend

Probability

0.58%

Chance of exploitation in the next 30 days

Percentile

48%

Versus all other CVEs

30-day change

Decrease -0.01 pp

From 0.59% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard145 products

aactl< 0.4.12-r39
buildkitd< 0.27.0-r1
buildkitd-fips< 0.27.0-r1
cg< 0.2.194-r0 | < 0.2.201-r0
chainctl< 0.2.194-r0 | < 0.2.206-r0

cloudbeat-8.17< 8.17.10-r5
cloudbeat-8.18< 8.18.8-r5
cloudbeat-8.19< 8.19.10-r0
cloudbeat-9.0< 9.0.8-r5
cloudbeat-9.1< 9.1.10-r0
cloudbeat-9.2< 9.2.2-r0
cloudbeat-fips-8.17< 8.17.10-r6
cloudbeat-fips-8.18< 8.18.8-r5
cloudbeat-fips-8.19< 8.19.10-r0
cloudbeat-fips-9.0< 9.0.8-r5
cloudbeat-fips-9.1< 9.1.10-r0
cloudbeat-fips-9.2< 9.2.4-r0
commercial-kyverno-1.15All versions (No fix recorded)
commercial-kyverno-background-controller-1.15All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.15All versions (No fix recorded)
commercial-kyverno-reports-controller-1.15All versions (No fix recorded)
commercial-kyvernopre-1.15All versions (No fix recorded)
cosign< 3.0.4-r2 | < 3.0.4-r1
cosign-fips< 3.0.4-r3 | < 3.0.4-r2
crossplane-1.20< 1.20.4-r2 | < 1.20.4-r3
crossplane-2.0< 2.0.6-r3 | < 2.0.6-r2
crossplane-2.1< 2.1.3-r4 | < 2.1.3-r2
crossplane-fips-1.20< 1.20.4-r2 | < 1.20.5-r1
crossplane-fips-2.0< 2.0.6-r4 | < 2.0.6-r2
crossplane-fips-2.1< 2.1.3-r2 | < 2.1.3-r4
dockerd-29< 29.2.0-r1
falcoctl< 0.12.1-r0 | < 0.12.2-r0
falcoctl-fips< 0.12.1-r0 | < 0.12.2-r0
flux-source-controller< 1.7.4-r5 | < 1.7.4-r6
flux-source-controller-fips< 1.7.4-r5 | < 1.7.4-r6
gh< 2.86.0-r0
gitsign< 0.13.0-r7 | < 0.14.0-r0
gitsign-credential-cache< 0.13.0-r7
goreleaser< 2.13.3-r3 | < 2.13.3-r1
image-factory< 0.9.0-r4 | < 0.9.0-r5
image-factory-fips< 1.0.2-r0 | < 0.9.0-r4
ko< 0.18.1-r1 | < 0.18.1-r2
ko-fips< 0.18.1-r1 | < 0.18.1-r2
kubescape< 3.0.47-r1 | < 3.0.48-r0
kyverno-1.13< 1.13.6-r13 | < 1.13.6-r12
kyverno-1.14< 1.14.5-r3 | < 1.14.5-r10
kyverno-1.15< 1.15.2-r5 | < 1.15.3-r11
kyverno-1.16< 1.16.2-r2 | < 1.16.3-r2
kyverno-background-controller-1.13< 1.13.6-r13 | < 1.13.6-r12
kyverno-background-controller-1.14< 1.14.5-r10 | < 1.14.5-r3
kyverno-background-controller-1.15< 1.15.2-r5 | < 1.15.3-r11
kyverno-background-controller-1.16< 1.16.2-r2 | < 1.16.3-r2
kyverno-background-controller-fips-1.13< 1.13.6-r13 | < 1.13.6-r12
kyverno-background-controller-fips-1.14< 1.14.5-r11 | < 1.14.5-r3
kyverno-background-controller-fips-1.15< 1.15.3-r10 | < 1.15.2-r4
kyverno-background-controller-fips-1.16< 1.16.3-r3 | < 1.16.2-r1
kyverno-cleanup-controller-1.13< 1.13.6-r12 | < 1.13.6-r13
kyverno-cleanup-controller-1.14< 1.14.5-r3 | < 1.14.5-r10
kyverno-cleanup-controller-1.15< 1.15.2-r5 | < 1.15.3-r11
kyverno-cleanup-controller-1.16< 1.16.2-r2 | < 1.16.3-r2
kyverno-cleanup-controller-fips-1.13< 1.13.6-r13 | < 1.13.6-r12
kyverno-cleanup-controller-fips-1.14< 1.14.5-r11 | < 1.14.5-r3
kyverno-cleanup-controller-fips-1.15< 1.15.3-r10 | < 1.15.2-r4
kyverno-cleanup-controller-fips-1.16< 1.16.3-r3 | < 1.16.2-r1
kyverno-cli-1.13< 1.13.6-r13 | < 1.13.6-r12
kyverno-cli-1.14< 1.14.5-r3 | < 1.14.5-r10
kyverno-cli-1.15< 1.15.2-r5 | < 1.15.3-r11
kyverno-cli-1.16< 1.16.3-r2 | < 1.16.2-r2
kyverno-cli-fips-1.13< 1.13.6-r12 | < 1.13.6-r13
kyverno-cli-fips-1.14< 1.14.5-r11 | < 1.14.5-r3
kyverno-cli-fips-1.15< 1.15.3-r10 | < 1.15.2-r4
kyverno-cli-fips-1.16< 1.16.2-r1 | < 1.16.3-r3
kyverno-fips-1.13< 1.13.6-r13 | < 1.13.6-r12
kyverno-fips-1.14< 1.14.5-r3 | < 1.14.5-r11
kyverno-fips-1.15< 1.15.3-r10 | < 1.15.2-r4
kyverno-fips-1.16< 1.16.3-r3 | < 1.16.2-r1
kyverno-init-container-1.13< 1.13.6-r13 | < 1.13.6-r12
kyverno-init-container-1.14< 1.14.5-r3 | < 1.14.5-r10
kyverno-init-container-1.15< 1.15.3-r11 | < 1.15.2-r5
kyverno-init-container-1.16< 1.16.2-r2 | < 1.16.3-r2
kyverno-init-container-fips-1.13< 1.13.6-r13 | < 1.13.6-r12
kyverno-init-container-fips-1.14< 1.14.5-r11 | < 1.14.5-r3
kyverno-init-container-fips-1.15< 1.15.2-r4 | < 1.15.3-r10
kyverno-init-container-fips-1.16< 1.16.3-r3 | < 1.16.2-r1
kyverno-notation-aws< 1.1-r28 | < 1.1-r35
kyverno-notation-aws-fips< 1.1-r28 | < 1.1-r34
kyverno-policy-reporter-plugins-kyverno< 0.5.3-r1 | < 0.5.3-r2
kyverno-policy-reporter-plugins-kyverno-fips< 0.5.3-r3 | < 0.5.3-r1
kyverno-reports-controller-1.13< 1.13.6-r12 | < 1.13.6-r13
kyverno-reports-controller-1.14< 1.14.5-r3 | < 1.14.5-r10
kyverno-reports-controller-1.15< 1.15.3-r11 | < 1.15.2-r5
kyverno-reports-controller-1.16< 1.16.2-r2 | < 1.16.3-r2
kyverno-reports-controller-fips-1.13< 1.13.6-r12 | < 1.13.6-r13
kyverno-reports-controller-fips-1.14< 1.14.5-r3 | < 1.14.5-r11
kyverno-reports-controller-fips-1.15< 1.15.2-r4 | < 1.15.3-r10
kyverno-reports-controller-fips-1.16< 1.16.3-r3 | < 1.16.2-r1
neuvector-sigstore-interface< 0_git20251212-r1 | < 0_git20251212-r5
neuvector-sigstore-interface-fips< 0_git20260130-r0 | < 0_git20260119-r0
policy-controller< 0.14.0-r0 | < 0.15.1-r0
policy-controller-fips< 0.14.0-r0 | < 0.15.1-r0
policy-controller-tester< 0.14.0-r0 | < 0.15.1-r0
policy-controller-tester-fips< 0.14.0-r0 | < 0.15.1-r0
ratify< 1.4.0-r9
ratify-fips< 1.4.0-r9
rekor-backfill-index< 1.5.0-r0
rekor-cli< 1.5.0-r0
rekor-fips-backfill-index< 1.5.0-r0
rekor-fips-cli< 1.5.0-r0
rekor-fips-server< 1.5.0-r0
rekor-server< 1.5.0-r0
reports-server< 0.1.6-r0
sigstore-scaffolding-fips-tuf-server< 0.7.31-r6 | < 0.7.31-r4
sigstore-scaffolding-tuf-server< 0.7.31-r5 | < 0.7.31-r3
skaffold< 2.17.1-r5 | < 2.17.1-r1
skaffold-fips< 2.17.1-r1 | < 2.17.1-r2
slsa-verifier< 2.7.1-r6 | < 2.7.1-r11
spire-agent< 1.14.1-r0 | < 1.14.1-r1
spire-agent-fips< 1.14.1-r0 | < 1.14.1-r3
tekton-chains< 0.26.0-r3 | < 0.26.0-r4
tekton-chains-fips< 0.26.0-r3 | < 0.26.0-r6
teleport-15-kube-agent-updater< 15.5.4-r9
teleport-16-kube-agent-updater< 16.5.18-r6
teleport-17< 17.7.13-r0 | < 17.7.20-r6
teleport-17-kube-agent-updater< 17.7.20-r5 | < 17.7.20-r6 | < 17.7.13-r0
teleport-17-operator< 17.7.20-r6
teleport-18< 18.6.1-r2 | < 18.7.2-r7 | < 18.7.2-r8
teleport-18-kube-agent-updater< 18.7.2-r7 | < 18.6.1-r2 | < 18.7.2-r8
teleport-18-operator< 18.7.2-r7 | < 18.7.2-r8
teleport-18.6< 18.6.8-r9
teleport-18.6-kube-agent-updater< 18.6.8-r9
teleport-18.6-operator< 18.6.8-r9
teleport-operator-fips-17< 17.7.23-r0
teleport-operator-fips-18< 18.7.5-r0
tflint< 0.60.0-r4
tflint-fips< 0.60.0-r4
tkn< 0.43.0-r5 | < 0.43.0-r2
tkn-fips< 0.43.0-r3 | < 0.43.0-r4
trivy< 0.69.0-r0 | < 0.68.2-r1
trivy-fips< 0.68.2-r1 | < 0.69.0-r0
trivy-operator< 0.29.0-r6 | < 0.29.0-r9
trivy-operator-fips< 0.29.0-r9 | < 0.29.0-r6
vexctl< 0.4.1-r5 | < 0.4.1-r7
witness< 0.10.2-r0 | < 0.10.2-r2
zarf< 0.70.1-r2 | < 0.69.0-r1
zot< 2.1.13-r0 | < 2.1.14-r0

Show all 145

Wolfi43 products

aactl< 0.4.12-r39
buildkitd< 0.27.0-r1
cosign< 3.0.4-r2 | < 3.0.4-r1
crossplane-2.1< 2.1.3-r4 | < 2.1.3-r2
dockerd-29< 29.2.0-r1

Show all 43

Debian1 product

golang-github-theupdateframework-go-tufAll versions (No fix recorded) | < 2.4.1+0.7.0-1

Github.com/theupdateframework/go-tuf1 product

v2< 2.3.1

Theupdateframework1 product

go-tuf≥ 2.0.0, < 2.3.1

Ubuntu1 product

golang-github-theupdateframework-go-tufAll versions (No fix recorded)

6 vendors · 192 products

References

9 links

github.com/theupdateframework/go-tuf/security/advisories/GHSA-846p-jg2w-w324X Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
github.com/theupdateframework/go-tuf/commit/73345ab6b0eb7e59d525dac17a428f043074cef6X Refsource MISCREPORTFIXWEBPatch
github.com/theupdateframework/go-tuf/releases/tag/v2.3.1X Refsource MISCREPORTWEBRelease Notes
ubuntu.com/security/CVE-2026-23991REPORT
www.cve.org/CVERecord?id=CVE-2026-23991REPORT
security-tracker.debian.org/tracker/CVE-2026-23991Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23991.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-23991AdvisoryOval
github.com/theupdateframework/go-tufPACKAGE