CVE catalog

CVE-2026-23992

DEBIAN-CVE-2026-23992

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.21% · Oct 25, 2026

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-theupdateframework-go-tuf132.0.2+0.7.0-1vulnerable
Debiangolang-github-theupdateframework-go-tuf132.3.0+0.7.0-1vulnerable
Debiangolang-github-theupdateframework-go-tuf132.4.1+0.7.0-1vulnerable
Debiangolang-github-theupdateframework-go-tuf132.4.1+0.7.0-2vulnerable
Debiangolang-github-theupdateframework-go-tuf132.4.1+0.7.0-2~expvulnerable
Debiangolang-github-theupdateframework-go-tuf132.4.2+0.7.0-1vulnerable
Debiangolang-github-theupdateframework-go-tuf142.0.2+0.7.0-1vulnerable
Debiangolang-github-theupdateframework-go-tuf142.3.0+0.7.0-1vulnerable
Debiangolang-github-theupdateframework-go-tuf142.4.1+0.7.0-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-theupdateframework-go-tufdeb142.4.1+0.7.0-1Not reportedDEBIAN-CVE-2026-23992Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]