TI-2026-19908 CVE-2026-24686 · GHSA-jqc5-w2xx-5vq4
go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names
Priority MEDIUM 55
go-tuf is a Go implementation of The Update Framework (TUF).
Vulnerabilities
7 records
TI-2026-19333 CVE-2026-23992 · GHSA-fphv-w9fq-2525
go-tuf improperly validates the configured threshold for delegations
Priority LOW 32
go-tuf is a Go implementation of The Update Framework (TUF).
TI-2026-19332 CVE-2026-23991 · GHSA-846p-jg2w-w324
go-tuf affected by client DoS via malformed server response
Priority LOW 34
go-tuf is a Go implementation of The Update Framework (TUF).
TI-2024-31823 CVE-2024-47534 · GHSA-4f8r-qqr9-fq8j
Incorrect delegation lookups can make go-tuf download the wrong artifact
Priority MEDIUM 42
go-tuf is a Go implementation of The Update Framework (TUF).
TI-2022-11717 CVE-2022-29173 · GHSA-66x3-6cw3-v5gj
No protection against rollback attacks in go-tuf
Priority MEDIUM 41
go-tuf is a Go implementation of The Update Framework (TUF).
TI-2021-17970 CVE-2021-41131 · GHSA-wjw6-2cqr-j4qr
Client metadata path-traversal in python-tuf
Priority MEDIUM 41
python-tuf is a Python reference implementation of The Update Framework (TUF).
TI-2020-11935 CVE-2020-15163 · GHSA-f8mr-jv2c-v8mg
Invalid root may become trusted root in The Update Framework (TUF)
Priority LOW 39
Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time.