CVE-2026-23991
📋 TL;DR
A denial-of-service vulnerability in go-tuf allows a compromised repository, mirror, or cache to crash client applications by sending malformed TUF metadata. This affects all systems using go-tuf versions 2.0.0 through 2.3.0 for software update verification. The panic occurs before signature validation, so attackers don't need signing keys.
💻 Affected Systems
- go-tuf
📦 What is this software?
Go Tuf by Theupdateframework
⚠️ Risk & Real-World Impact
Worst Case
Critical systems relying on go-tuf for updates become unavailable, potentially disrupting operations or preventing security updates.
Likely Case
Temporary service disruption for applications using go-tuf until they restart, with potential cascading failures in dependent systems.
If Mitigated
Minimal impact with proper monitoring and rapid restart capabilities, though still causes service interruptions.
🎯 Exploit Status
Attack requires ability to serve malicious metadata to client, which could be achieved through repository compromise, cache poisoning, or MITM attacks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.1
Vendor Advisory: https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-846p-jg2w-w324
Restart Required: Yes
Instructions:
Update go-tuf dependency to version 2.3.1 or later
Run 'go get github.com/theupdateframework/go-tuf/v2@v2.3.1'
Rebuild and redeploy affected applications
🔧 Temporary Workarounds
No workarounds available
allThe advisory states no known workarounds exist
🧯 If You Can't Patch
- Implement network controls to restrict go-tuf clients to trusted repositories only
- Monitor for application crashes and implement automatic restart mechanisms
🔍 How to Verify
Check if Vulnerable:
Check go.mod or go.sum for go-tuf dependency version 2.0.0 through 2.3.0Check Version:
grep 'github.com/theupdateframework/go-tuf' go.modVerify Fix Applied:
Verify go-tuf version is 2.3.1 or later in go.mod/go.sum📡 Detection & Monitoring
Log Indicators:
- Application panic logs containing 'panic:' with go-tuf stack traces
- Sudden application termination without normal shutdown
Network Indicators:
- Unusual traffic patterns to/from update repositories
- Failed update attempts followed by service disruption
SIEM Query:
source="application.logs" AND "panic:" AND "go-tuf"