Repository navigation
Update module github.com/theupdateframework/go-tuf/v2 to v2.4.1 [SECURITY] - autoclosed - #373
Closed
renovate-update-app[bot] wants to merge 1 commit into
Conversation
![renovatee-approver-stackvista[bot]](https://avatars.githubusercontent.com/u/10511829?s=60&v=4){kind=small}
renovate-update-app
Bot
changed the title
auto-merge was automatically disabled
October 26, 2026 08:36
Pull request was closed
renovate-update-app
Bot
deleted the
renovate/go-github.com-theupdateframework-go-tuf-v2-vulnerability
branch
October 26, 2026 08:36
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v2.3.0→v2.4.1Warning
Some dependencies could not be looked up. Check the warning logs for more information.
go-tuf affected by client DoS via malformed server response
CVE-2026-23991 / GHSA-846p-jg2w-w324
More information
Details
Security Disclosure: Client DoS via malformed server response
Summary
If the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a DoS. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key.
Impact
Client crashes upon receiving and parsing malformed TUF metadata. This can cause long running services to enter an restart/crash loop.
Workarounds
None currently.
Affected code
The
metadata.checkTypefunction did not properly type assert the (untrusted) input causing it to panic on malformed data.Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
go-tuf improperly validates the configured threshold for delegations
CVE-2026-23992 / GHSA-fphv-w9fq-2525
More information
Details
Security Disclosure: Improper validation of configured threshold for delegations
Summary
A compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification.
Impact
Unathorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made.
Patches
Upgrade to v2.3.1
Workarounds
Always make sure that the TUF metadata roles are configured with a threshold of at least 1.
Affected code:
The
metadata.VerifyDelegatedid not verify the configured threshold prior to comparison. This means that a misconfigured TUF repository could disable the signature verification by setting the threshold to 0, or a negative value (and so always make the signature threshold computation to pass).Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names
CVE-2026-24686 / GHSA-jqc5-w2xx-5vq4
More information
Details
Security Vulnerability: Path Traversal in TAP 4 Multirepo Client
Summary
go-tuf's TAP 4 Multirepo Client uses the map file repository name string (
repoName) as a filesystem path component when selecting the local metadata cache directory. If an application accepts a map file from an untrusted source, an attacker can supply arepoNamecontaining traversal (e.g.,../escaped-repo) and cause go-tuf to create directories and write the root metadata file outside the intendedLocalMetadataDircache base, within the running process's filesystem permissions.Affected Component
metadata/multirepo/multirepo.go(*MultiRepoClient) initTUFClients() errormetadataDir := filepath.Join(client.Config.LocalMetadataDir, repoName)(around line 129 at the pinned commit)Impact
When the TAP 4 map file content is attacker-controlled, this enables arbitrary file write relative to the process permissions (via metadata persistence during client initialization). This can be used to overwrite files writable by the process (for example, configuration files in writable directories) and may enable further compromise depending on the deployment environment.
Attacker Model
repositorieskeys are attacker-controlled (for example: fetched from a URL, supply-chain substituted, or otherwise attacker-influenced input).DisableLocalCache=false) and the configuredLocalMetadataDiris writable by the running process.Claim Ceiling: HIGH when the map file is attacker-controlled; if the map file is always local and trusted, this is closer to a configuration footgun and likely lands as MEDIUM/LOW.
bde5f18dc95dfac365fc452ee4e278e5fd66d4b4(tag v2.4.0)Reproduction
Attachments include
poc.zipwith:canonical.log(contains[CALLSITE_HIT],[PROOF_MARKER])control.log(contains[CALLSITE_HIT],[NC_MARKER], does not contain[PROOF_MARKER])fix.patch(minimal validation sketch)Expected: Multirepo repository names are treated as identifiers; a TAP 4 map file containing traversal or absolute paths is rejected (or safely normalized so that all writes stay under
LocalMetadataDir).Actual: A traversal
repoNameescapesLocalMetadataDirand go-tuf persistsroot.jsonunder the escaped path during initialization.Run Local Repro
rm -rf _poc mkdir -p _poc unzip -q -o poc.zip -d _poc cd _poc/poc make canonical make controlWorkarounds
./..).DisableLocalCache=true).Suggested Remediation
Validate multirepo repository names as identifiers (not paths) before using them in
filepath.Join. Reject:/and\).and..)If it is important to accept a wider set of repo names, a safer alternative is to map repo names to a stable, validated directory name (for example via encoding or hashing) and to ensure all writes stay under the cache base directory.
Triage Questions
Attachments
Reported by: Oleh
Severity
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
go-tuf affected by client DoS via malformed server response
CVE-2026-23991 / GHSA-846p-jg2w-w324 / GO-2026-4348
More information
Details
Security Disclosure: Client DoS via malformed server response
Summary
If the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a DoS. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key.
Impact
Client crashes upon receiving and parsing malformed TUF metadata. This can cause long running services to enter an restart/crash loop.
Workarounds
None currently.
Affected code
The
metadata.checkTypefunction did not properly type assert the (untrusted) input causing it to panic on malformed data.Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
go-tuf improperly validates the configured threshold for delegations
CVE-2026-23992 / GHSA-fphv-w9fq-2525 / GO-2026-4349
More information
Details
Security Disclosure: Improper validation of configured threshold for delegations
Summary
A compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification.
Impact
Unathorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made.
Patches
Upgrade to v2.3.1
Workarounds
Always make sure that the TUF metadata roles are configured with a threshold of at least 1.
Affected code:
The
metadata.VerifyDelegatedid not verify the configured threshold prior to comparison. This means that a misconfigured TUF repository could disable the signature verification by setting the threshold to 0, or a negative value (and so always make the signature threshold computation to pass).Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Client DoS via malformed server response in github.com/theupdateframework/go-tuf
CVE-2026-23991 / GHSA-846p-jg2w-w324 / GO-2026-4348
More information
Details
Client DoS via malformed server response in github.com/theupdateframework/go-tuf
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Improper validattion of configured threshold for delegations in github.com/theupdateframework/go-tuf
CVE-2026-23992 / GHSA-fphv-w9fq-2525 / GO-2026-4349
More information
Details
Improper validattion of configured threshold for delegations in github.com/theupdateframework/go-tuf
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names
CVE-2026-24686 / GHSA-jqc5-w2xx-5vq4 / GO-2026-4377
More information
Details
Security Vulnerability: Path Traversal in TAP 4 Multirepo Client
Summary
go-tuf's TAP 4 Multirepo Client uses the map file repository name string (
repoName) as a filesystem path component when selecting the local metadata cache directory. If an application accepts a map file from an untrusted source, an attacker can supply arepoNamecontaining traversal (e.g.,../escaped-repo) and cause go-tuf to create directories and write the root metadata file outside the intendedLocalMetadataDircache base, within the running process's filesystem permissions.Affected Component
metadata/multirepo/multirepo.go(*MultiRepoClient) initTUFClients() errormetadataDir := filepath.Join(client.Config.LocalMetadataDir, repoName)(around line 129 at the pinned commit)Impact
When the TAP 4 map file content is attacker-controlled, this enables arbitrary file write relative to the process permissions (via metadata persistence during client initialization). This can be used to overwrite files writable by the process (for example, configuration files in writable directories) and may enable further compromise depending on the deployment environment.
Attacker Model
repositorieskeys are attacker-controlled (for example: fetched from a URL, supply-chain substituted, or otherwise attacker-influenced input).DisableLocalCache=false) and the configuredLocalMetadataDiris writable by the running process.Claim Ceiling: HIGH when the map file is attacker-controlled; if the map file is always local and trusted, this is closer to a configuration footgun and likely lands as MEDIUM/LOW.
bde5f18dc95dfac365fc452ee4e278e5fd66d4b4(tag v2.4.0)Reproduction
Attachments include
poc.zipwith:canonical.log(contains[CALLSITE_HIT],[PROOF_MARKER])control.log(contains[CALLSITE_HIT],[NC_MARKER], does not contain[PROOF_MARKER])fix.patch(minimal validation sketch)Expected: Multirepo repository names are treated as identifiers; a TAP 4 map file containing traversal or absolute paths is rejected (or safely normalized so that all writes stay under
LocalMetadataDir).Actual: A traversal
repoNameescapesLocalMetadataDirand go-tuf persistsroot.jsonunder the escaped path during initialization.Run Local Repro
rm -rf _poc mkdir -p _poc unzip -q -o poc.zip -d _poc cd _poc/poc make canonical make controlWorkarounds
./..).DisableLocalCache=true).Suggested Remediation
Validate multirepo repository names as identifiers (not paths) before using them in
filepath.Join. Reject:/and\).and..)If it is important to accept a wider set of repo names, a safer alternative is to map repo names to a stable, validated directory name (for example via encoding or hashing) and to ensure all writes stay under the cache base directory.
Triage Questions
Attachments
Reported by: Oleh
Severity
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Path traversal in TAP 4 multirepo client allows arbitrary file write via repo names in github.com/theupdateframework/go-tuf
CVE-2026-24686 / GHSA-jqc5-w2xx-5vq4 / GO-2026-4377
More information
Details
Path traversal in TAP 4 multirepo client allows arbitrary file write via repo names in github.com/theupdateframework/go-tuf
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Release Notes
theupdateframework/go-tuf (github.com/theupdateframework/go-tuf/v2)
v2.4.1Compare Source
What's Changed
Full Changelog: theupdateframework/go-tuf@v2.4.0...v2.4.1
v2.4.0Compare Source
What's Changed
Full Changelog: theupdateframework/go-tuf@v2.3.1...v2.4.0
v2.3.1Compare Source
What's Changed
Full Changelog: theupdateframework/go-tuf@v2.3.0...v2.3.1
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.