CVE-2026-23991Medium· 5.9▾ Sunlitgo-tuf affected by client DoS via malformed server response
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.5%
Last analysed / modified upstream
0.5% → 0.6%
If the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a DoS. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key.
Client crashes upon receiving and parsing malformed TUF metadata. This can cause long running services to enter an restart/crash loop.
None currently.
The metadata.checkType function did not properly type assert the (untrusted) input causing it to panic on malformed data.
github.com/theupdateframework/go-tuf/v2 < 2.3.1Upgrade to a patched release:
github.com/theupdateframework/go-tuf/v2 2.3.1Connected by shared product, vendor, weakness, or advisory.