What’s Vulnerable › Vulnerabilities

CVE-2025-2888: Improper timestamp caching during snapshot rollback in tough

• Severity: medium (CVSS 4.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-27 · updated 2026-06-17
• Weakness: CWE-1025

Description

During a snapshot rollback, the client incorrectly caches the timestamp metadata. If the client checks the cache when attempting to perform the next update, the update timestamp validation will fail, preventing the next update until the cache is cleared. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Affected products

• AWS tough: before 0.20.0 — fixed in 0.20.0

How to fix

Upgrade to a fixed version: AWS tough 0.20.0. Check the vendor advisory for mitigations.

References

• https://aws.amazon.com/security/security-bulletins/AWS-2025-007/
• https://github.com/awslabs/tough/releases/tag/tough-v0.20.0
• https://github.com/awslabs/tough/security/advisories/GHSA-76g3-38jv-wxh4

Get alerted when CVE-2025-2888 or the next vulnerability affects your stack