CVE-2026-23991
Theupdateframework Go-Tuf 2.0.0 – 2.3.1
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2026-23991 is a medium-severity Reachable Assertion (CWE-617) vulnerability in Theupdateframework Go-Tuf. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 42th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-23991 affects go-tuf, a Go implementation of The Update Framework (TUF), in versions starting from 2.0.0 and prior to 2.3.1. The vulnerability arises when a TUF repository, its mirrors, or caches return invalid TUF metadata JSON—specifically, JSON that is syntactically valid but not well-formed according to TUF specifications. During parsing, the client panics before any signature validation occurs, resulting in a denial-of-service condition. The issue is rated with a CVSS v3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-617 (Reachable Assertion) and CWE-754 (Improper Check for Unusual or Exceptional Conditions).
An attacker who compromises a TUF repository, mirror, or cache can exploit this vulnerability by serving malformed TUF metadata JSON. No signing keys are required, as the panic triggers during initial parsing prior to signature checks. This enables remote denial-of-service against clients over the network, with no privileges, user interaction, or scope changes needed, though exploitation requires high attack complexity. Affected clients crash, disrupting software update processes that rely on go-tuf for secure metadata handling.
The go-tuf project addresses the issue in version 2.3.1, which includes a fix via commit 73345ab6b0eb7e59d525dac17a428f043074cef6. The security advisory (GHSA-846p-jg2w-w324) and release notes for v2.3.1 detail the patch and affected versions. No workarounds are available.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3673
Vulnerability Data
go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF…
more
metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 7 hardening rules · 2 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation finds reachable assertions during development.
Input validation directly requires checking for unexpected or malformed conditions before they propagate.
Security engineering principles discourage use of assertions for handling untrusted input.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent unsafe assertions from being coded in reachable paths.
Runtime monitoring of software can detect assertion-triggered crashes as adverse events.
Vulnerability identification processes can discover and record reachable-assertion flaws before deployment.
Generating logs of exceptions and errors enables detection of improper handling of unusual conditions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect reachable assertions before release, reducing the likelihood of exploitation.
Logging can record unhandled exceptions but does not prevent the weakness itself.
Monitoring may detect symptoms of unhandled conditions but does not eliminate the root weakness.
Secure development lifecycle mandates defensive coding and input validation that prevent reachable assertions from being triggered by untrusted data.
Application security requirements can specify that assertions must not be reachable from attacker-controlled inputs.
Secure architecture principles discourage the use of assertions for runtime error handling that an attacker could exploit.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248574 YUM must be configured to prevent the installation of patches, service packs, device drivers, or OL 8 system components that have not been digitally signed using a certificate that is recognized and approved by the organization. prevents CWE-754
- V-248575 OL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. prevents CWE-754
Oracle Linux 9 (1 rule)
- V-271452 OL 9 must use a Linux Security Module configured to enforce limits on system services. prevents CWE-754