What’s Vulnerable › Vulnerabilities

CVE-2024-47534: Incorrect delegation lookups can make go-tuf download the wrong artifact

• Severity: high (CVSS 8.2 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-10-01 · updated 2026-06-17
• Weakness: CWE-362

Description

go-tuf is a Go implementation of The Update Framework (TUF). The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly trace the delegations "B"->"C"->"A". This vulnerability is fixed in 2.0.1.

Affected products

• theupdateframework go-tuf: before 2.0.1 — fixed in 2.0.1

How to fix

Upgrade to a fixed version: theupdateframework go-tuf 2.0.1. Check the vendor advisory for mitigations.

References

• https://github.com/theupdateframework/go-tuf/blob/f95222bdd22d2ac4e5b8ed6fe912b645e213c3b5/metadata/metadata.go#L565-L580
• https://github.com/theupdateframework/go-tuf/commit/edc30b474f5afd4cc603e17149704d5aa605151d
• https://github.com/theupdateframework/go-tuf/commit/f36420caba9edbfdfd64f95a9554c0836d9cf819
• https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-4f8r-qqr9-fq8j
• https://github.com/theupdateframework/tuf-conformance/pull/115

Get alerted when CVE-2024-47534 or the next vulnerability affects your stack