CVE-2025-2887: Failure to detect delegated target rollback in tough

Severity: medium (CVSS 4.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-27 · updated 2026-06-17
Weakness: CWE-1025

Description

During a target rollback, the client fails to detect the rollback for delegated targets. This could cause the client to fetch a target from an incorrect source, altering the target contents. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Affected products

AWS tough: before 0.20.0 — fixed in 0.20.0

How to fix

Upgrade to a fixed version: AWS tough 0.20.0. Check the vendor advisory for mitigations.

References

https://aws.amazon.com/security/security-bulletins/AWS-2025-007/
https://github.com/awslabs/tough/releases/tag/tough-v0.20.0
https://github.com/awslabs/tough/security/advisories/GHSA-q6r9-r9pw-4cf7

Get alerted when CVE-2025-2887 or the next vulnerability affects your stack