TI-2026-19908 CVE-2026-24686 · GHSA-jqc5-w2xx-5vq4
go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names
Priority MEDIUM 55
go-tuf is a Go implementation of The Update Framework (TUF).
theupdateframework
Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9
Exploited now
theupdateframework records in CISA KEVNo theupdateframework vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
7 records
TI-2024-31823 CVE-2024-47534 · GHSA-4f8r-qqr9-fq8j
Incorrect delegation lookups can make go-tuf download the wrong artifact
Priority MEDIUM 42
go-tuf is a Go implementation of The Update Framework (TUF).
TI-2022-11717 CVE-2022-29173 · GHSA-66x3-6cw3-v5gj
No protection against rollback attacks in go-tuf
Priority MEDIUM 41
go-tuf is a Go implementation of The Update Framework (TUF).
TI-2021-17970 CVE-2021-41131 · GHSA-wjw6-2cqr-j4qr
Client metadata path-traversal in python-tuf
Priority MEDIUM 41
python-tuf is a Python reference implementation of The Update Framework (TUF).
TI-2020-11935 CVE-2020-15163 · GHSA-f8mr-jv2c-v8mg
Invalid root may become trusted root in The Update Framework (TUF)
Priority LOW 39
Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time.
TI-2026-19332 CVE-2026-23991 · GHSA-846p-jg2w-w324
go-tuf affected by client DoS via malformed server response
Priority LOW 34
go-tuf is a Go implementation of The Update Framework (TUF).
TI-2026-19333 CVE-2026-23992 · GHSA-fphv-w9fq-2525
go-tuf improperly validates the configured threshold for delegations
Priority LOW 32
go-tuf is a Go implementation of The Update Framework (TUF).