What’s Vulnerable › Products

theupdateframework go-tuf vulnerabilities

5 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Check whether your theupdateframework go-tuf version is affected

Latest theupdateframework go-tuf vulnerabilities

• CVE-2026-24686 — go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names (CVSS 4.7)
• CVE-2026-23992 — go-tuf improperly validates the configured threshold for delegations (CVSS 7.5)
• CVE-2026-23991 — go-tuf affected by client DoS via malformed server response (CVSS 7.5)
• CVE-2024-47534 — Incorrect delegation lookups can make go-tuf download the wrong artifact (CVSS 8.2)
• CVE-2022-29173 — No protection against rollback attacks in go-tuf (CVSS 8.8)