CVE-2026-23991
Medium · 5.9CVSS
5.9
EPSS
0.6%
Published
Jan 22, 2026
CISA due date
—
The record
go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/theupdateframework/go-tuf/v2 | 0 | 2.3.1 |
| Chainguard | aactl | 0 | 0.4.12-r39 |
| Chainguard | buildkitd | 0 | 0.27.0-r1 |
| Chainguard | buildkitd-fips | 0 | 0.27.0-r1 |
| Chainguard | cg | 0 | 0.2.201-r0 |
| Chainguard | chainctl | 0 | 0.2.206-r0 |
| Chainguard | cloudbeat-8.17 | 0 | 8.17.10-r5 |
| Chainguard | cloudbeat-8.18 | 0 | 8.18.8-r5 |
| Chainguard | cloudbeat-8.19 | 0 | 8.19.10-r0 |
| Chainguard | cloudbeat-9.0 | 0 | 9.0.8-r5 |
| Chainguard | cloudbeat-9.1 | 0 | 9.1.10-r0 |
| Chainguard | cloudbeat-9.2 | 0 | 9.2.2-r0 |
| Chainguard | cloudbeat-fips-8.17 | 0 | 8.17.10-r6 |
| Chainguard | cloudbeat-fips-8.18 | 0 | 8.18.8-r5 |
| Chainguard | cloudbeat-fips-8.19 | 0 | 8.19.10-r0 |
| Chainguard | cloudbeat-fips-9.0 | 0 | 9.0.8-r5 |
| Chainguard | cloudbeat-fips-9.1 | 0 | 9.1.10-r0 |
| Chainguard | cloudbeat-fips-9.2 | 0 | 9.2.4-r0 |
| Chainguard | cosign | 0 | 3.0.4-r2 |
| Chainguard | cosign-fips | 0 | 3.0.4-r3 |
| Chainguard | crossplane-1.20 | 0 | 1.20.4-r3 |
| Chainguard | crossplane-2.0 | 0 | 2.0.6-r3 |
| Chainguard | crossplane-2.1 | 0 | 2.1.3-r4 |
| Chainguard | crossplane-fips-1.20 | 0 | 1.20.4-r4 |
| Chainguard | crossplane-fips-2.0 | 0 | 2.0.6-r4 |
| Chainguard | crossplane-fips-2.1 | 0 | 2.1.3-r3 |
| Chainguard | crossplane-fips-2.1 | 0 | 2.1.3-r4 |
| Chainguard | dockerd-29 | 0 | 29.2.0-r1 |
| Chainguard | falcoctl | 0 | 0.12.2-r0 |
| Chainguard | falcoctl-fips | 0 | 0.12.2-r0 |
| Chainguard | flux-source-controller | 0 | 1.7.4-r6 |
| Chainguard | flux-source-controller-fips | 0 | 1.7.4-r6 |
| Chainguard | gh | 0 | 2.86.0-r0 |
| Chainguard | gitsign | 0 | 0.14.0-r0 |
| Chainguard | gitsign-credential-cache | 0 | 0.13.0-r7 |
| Chainguard | goreleaser | 0 | 2.13.3-r3 |
| Chainguard | image-factory | 0 | 0.9.0-r5 |
| Chainguard | image-factory-fips | 0 | 1.0.2-r0 |
| Chainguard | ko | 0 | 0.18.1-r2 |
| Chainguard | ko-fips | 0 | 0.18.1-r2 |
| Chainguard | kubescape | 0 | 3.0.48-r0 |
| Chainguard | kyverno-1.12 | 0 | 1.12.7-r25 |
| Chainguard | kyverno-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-background-controller-1.12 | 0 | 1.12.7-r25 |
| Chainguard | kyverno-background-controller-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-background-controller-fips-1.12 | 0 | 1.12.7-r28 |
| Chainguard | kyverno-background-controller-fips-1.16 | 0 | 1.16.3-r3 |
| Chainguard | kyverno-cleanup-controller-1.12 | 0 | 1.12.7-r25 |
| Chainguard | kyverno-cleanup-controller-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-cleanup-controller-fips-1.12 | 0 | 1.12.7-r28 |
| Chainguard | kyverno-cleanup-controller-fips-1.16 | 0 | 1.16.3-r3 |
| Chainguard | kyverno-cli-1.12 | 0 | 1.12.7-r25 |
| Chainguard | kyverno-cli-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-cli-fips-1.12 | 0 | 1.12.7-r28 |
| Chainguard | kyverno-cli-fips-1.16 | 0 | 1.16.3-r3 |
| Chainguard | kyverno-fips-1.12 | 0 | 1.12.7-r28 |
| Chainguard | kyverno-fips-1.16 | 0 | 1.16.3-r3 |
| Chainguard | kyverno-init-container-1.12 | 0 | 1.12.7-r25 |
| Chainguard | kyverno-init-container-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-init-container-fips-1.12 | 0 | 1.12.7-r28 |
| Chainguard | kyverno-init-container-fips-1.16 | 0 | 1.16.3-r3 |
| Chainguard | kyverno-notation-aws | 0 | 1.1-r35 |
| Chainguard | kyverno-notation-aws-fips | 0 | 1.1-r34 |
| Chainguard | kyverno-policy-reporter-plugins-kyverno | 0 | 0.5.3-r2 |
| Chainguard | kyverno-policy-reporter-plugins-kyverno-fips | 0 | 0.5.3-r3 |
| Chainguard | kyverno-reports-controller-1.12 | 0 | 1.12.7-r25 |
| Chainguard | kyverno-reports-controller-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-reports-controller-fips-1.12 | 0 | 1.12.7-r28 |
| Chainguard | kyverno-reports-controller-fips-1.16 | 0 | 1.16.3-r3 |
| Chainguard | neuvector-sigstore-interface | 0 | 0_git20251212-r5 |
| Chainguard | neuvector-sigstore-interface-fips | 0 | 0_git20260130-r0 |
| Chainguard | policy-controller | 0 | 0.15.1-r0 |
| Chainguard | policy-controller-fips | 0 | 0.15.1-r0 |
| Chainguard | policy-controller-tester | 0 | 0.15.1-r0 |
| Chainguard | policy-controller-tester-fips | 0 | 0.15.1-r0 |
| Chainguard | ratify | 0 | 1.4.0-r9 |
| Chainguard | ratify-fips | 0 | 1.4.0-r9 |
| Chainguard | rekor-backfill-index | 0 | 1.5.0-r0 |
| Chainguard | rekor-cli | 0 | 1.5.0-r0 |
| Chainguard | rekor-fips-backfill-index | 0 | 1.5.0-r0 |
| Chainguard | rekor-fips-cli | 0 | 1.5.0-r0 |
| Chainguard | rekor-fips-server | 0 | 1.5.0-r0 |
| Chainguard | rekor-server | 0 | 1.5.0-r0 |
| Chainguard | reports-server | 0 | 0.1.6-r0 |
| Chainguard | sigstore-scaffolding-fips-tuf-server | 0 | 0.7.31-r6 |
| Chainguard | sigstore-scaffolding-tuf-server | 0 | 0.7.31-r5 |
| Chainguard | skaffold | 0 | 2.17.1-r5 |
| Chainguard | skaffold-fips | 0 | 2.17.1-r2 |
| Chainguard | slsa-verifier | 0 | 2.7.1-r11 |
| Chainguard | spire-agent | 0 | 1.14.1-r1 |
| Chainguard | spire-agent-fips | 0 | 1.14.1-r3 |
| Chainguard | tekton-chains | 0 | 0.26.0-r4 |
| Chainguard | tekton-chains-fips | 0 | 0.26.0-r6 |
| Chainguard | teleport-15-kube-agent-updater | 0 | 15.5.4-r9 |
| Chainguard | teleport-16-kube-agent-updater | 0 | 16.5.18-r6 |
| Chainguard | teleport-18.6 | 0 | 18.6.8-r9 |
| Chainguard | teleport-18.6-kube-agent-updater | 0 | 18.6.8-r9 |
| Chainguard | teleport-18.6-operator | 0 | 18.6.8-r9 |
| Chainguard | tflint | 0 | 0.60.0-r4 |
| Chainguard | tflint-fips | 0 | 0.60.0-r4 |
| Chainguard | tkn | 0 | 0.43.0-r5 |
| Chainguard | tkn-fips | 0 | 0.43.0-r4 |
| Chainguard | trivy | 0 | 0.69.0-r0 |
| Chainguard | trivy-fips | 0 | 0.69.0-r0 |
| Chainguard | trivy-operator | 0 | 0.29.0-r9 |
| Chainguard | trivy-operator-fips | 0 | 0.29.0-r9 |
| Chainguard | vexctl | 0 | 0.4.1-r7 |
| Chainguard | witness | 0 | 0.10.2-r2 |
| Chainguard | zarf | 0 | 0.70.1-r2 |
| Chainguard | zot | 0 | 2.1.14-r0 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | cosign | 0 | 3.0.5-150400.3.35.1 |
| Wolfi | aactl | 0 | 0.4.12-r39 |
| Wolfi | buildkitd | 0 | 0.27.0-r1 |
| Wolfi | cosign | 0 | 3.0.4-r2 |
| Wolfi | cosign-fips | 0 | 3.0.4-r3 |
| Wolfi | crossplane-2.1 | 0 | 2.1.3-r4 |
| Wolfi | dockerd-29 | 0 | 29.2.0-r1 |
| Wolfi | falcoctl | 0 | 0.12.2-r0 |
| Wolfi | flux-source-controller | 0 | 1.7.4-r6 |
| Wolfi | gh | 0 | 2.86.0-r0 |
| Wolfi | gitsign | 0 | 0.14.0-r0 |
| Wolfi | gitsign-credential-cache | 0 | 0.13.0-r7 |
| Wolfi | goreleaser | 0 | 2.13.3-r3 |
| Wolfi | ko | 0 | 0.18.1-r2 |
| Wolfi | ko-fips | 0 | 0.18.1-r2 |
| Wolfi | kubescape | 0 | 3.0.48-r0 |
| Wolfi | kyverno-1.12 | 0 | 1.12.7-r25 |
| Wolfi | kyverno-1.16 | 0 | 1.16.3-r2 |
| Wolfi | kyverno-background-controller-1.12 | 0 | 1.12.7-r25 |
| Wolfi | kyverno-background-controller-1.16 | 0 | 1.16.3-r2 |
| Wolfi | kyverno-cleanup-controller-1.12 | 0 | 1.12.7-r25 |
| Wolfi | kyverno-cleanup-controller-1.16 | 0 | 1.16.3-r2 |
| Wolfi | kyverno-cli-1.12 | 0 | 1.12.7-r25 |
| Wolfi | kyverno-cli-1.16 | 0 | 1.16.3-r2 |
| Wolfi | kyverno-init-container-1.12 | 0 | 1.12.7-r25 |
| Wolfi | kyverno-init-container-1.16 | 0 | 1.16.3-r2 |
| Wolfi | kyverno-notation-aws | 0 | 1.1-r35 |
| Wolfi | kyverno-reports-controller-1.12 | 0 | 1.12.7-r25 |
| Wolfi | kyverno-reports-controller-1.16 | 0 | 1.16.3-r2 |
| Wolfi | neuvector-sigstore-interface | 0 | 0_git20251212-r5 |
| Wolfi | policy-controller | 0 | 0.15.1-r0 |
| Wolfi | policy-controller-tester | 0 | 0.15.1-r0 |
| Wolfi | ratify | 0 | 1.4.0-r9 |
| Wolfi | rekor-backfill-index | 0 | 1.5.0-r0 |
| Wolfi | rekor-cli | 0 | 1.5.0-r0 |
| Wolfi | rekor-server | 0 | 1.5.0-r0 |
| Wolfi | sigstore-scaffolding-tuf-server | 0 | 0.7.31-r5 |
| Wolfi | skaffold | 0 | 2.17.1-r5 |
| Wolfi | slsa-verifier | 0 | 2.7.1-r11 |
| Wolfi | spire-agent | 0 | 1.14.1-r1 |
| Wolfi | tekton-chains | 0 | 0.26.0-r4 |
| Wolfi | teleport-18.6 | 0 | 18.6.8-r9 |
| Wolfi | teleport-18.6-kube-agent-updater | 0 | 18.6.8-r9 |
| Wolfi | teleport-18.6-operator | 0 | 18.6.8-r9 |
| Wolfi | tflint | 0 | 0.60.0-r4 |
| Wolfi | tkn | 0 | 0.43.0-r5 |
| Wolfi | trivy | 0 | 0.69.0-r0 |
| Wolfi | trivy-operator | 0 | 0.29.0-r9 |
| Wolfi | vexctl | 0 | 0.4.1-r7 |
| Wolfi | witness | 0 | 0.10.2-r2 |
| Wolfi | zarf | 0 | 0.70.1-r2 |
| Wolfi | zot | 0 | 2.1.14-r0 |
| openSUSE:Leap 15.6 | cosign | 0 | 3.0.5-150400.3.35.1 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260205T172317-150000.1.146.1 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260226T182644-150000.1.149.1 |
| openSUSE:Leap 16.0 | cosign | 0 | 3.0.5-160000.1.1 |
| openSUSE:Tumbleweed | cosign | 0 | 3.0.5-1.1 |
Related vulnerabilities
- CVE-2026-24686 go-tuf is a Go implementation of The Update Framework (TUF). Also affects github.com/theupdateframework/go-tuf/v2
- CVE-2026-23992 go-tuf is a Go implementation of The Update Framework (TUF). Also affects github.com/theupdateframework/go-tuf/v2
- CVE-2024-47534 go-tuf is a Go implementation of The Update Framework (TUF). Also affects github.com/theupdateframework/go-tuf/v2
- CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Also affects aactl
- CVE-2025-15558 Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins… Also affects aactl
- CVE-2026-1229 The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an… Also affects aactl
- CVE-2026-26958 filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with… Also affects aactl
- CVE-2025-68121 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or… Also affects aactl