DEBIAN-CVE-2026-23992

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-23992

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-23992.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-23992

Upstream

CVE-2026-23992

Published

2026-01-22T03:15:47.470Z

Modified

2026-01-22T23:16:04.847544Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

[none]

Details

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.

References

https://security-tracker.debian.org/tracker/CVE-2026-23992

Affected packages

Debian:13 / golang-github-theupdateframework-go-tuf

Package

Name: golang-github-theupdateframework-go-tuf
Purl: pkg:deb/debian/golang-github-theupdateframework-go-tuf?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.0.2+0.7.0-1

2.3.0+0.7.0-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-23992.json"

Debian:14 / golang-github-theupdateframework-go-tuf