CVE-2026-23991

Name of the Vulnerable Software and Affected Versions go-tuf versions 2.0.0 through 2.3.0

Description go-tuf, a Go implementation of The Update Framework (TUF), is susceptible to a denial of service. When processing TUF metadata, versions prior to 2.3.1 may panic if invalid JSON is received from the repository or its mirrors. This occurs before signature validation, allowing a compromised repository or mirror to disrupt client operations without requiring signing key access.

Recommendations Update to version 2.3.1 or later.