How many CVEs does theupdateframework go-tuf have?

theupdateframework go-tuf has 5 published CVE records since 2022.

How many theupdateframework go-tuf CVEs are in CISA KEV?

None of theupdateframework go-tuf's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Are there public exploits for theupdateframework go-tuf vulnerabilities?

Yes — 1 of theupdateframework go-tuf's CVEs have a known public exploit.

Which versions of theupdateframework go-tuf are affected?

36 distinct theupdateframework go-tuf versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in theupdateframework go-tuf CVEs?

theupdateframework go-tuf's CVEs most often map to these CWE weakness types: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-347 (Improper Verification of Cryptographic Signature), CWE-354 (Improper Validation of Integrity Check Value), CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')).

What is the average severity of theupdateframework go-tuf CVEs?

The average CVSS base score across theupdateframework go-tuf's scored CVEs is 7.4.

theupdateframework go-tuf Vulnerabilities: CVEs, CISA KEV & Security Advisories

Affected versions and CVEs

Browse every theupdateframework go-tuf version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

2.0.04 CVEs
2.0.13 CVEs
2.0.23 CVEs
2.1.03 CVEs
2.1.13 CVEs
2.2.03 CVEs
2.3.03 CVEs
0.1.02 CVEs
0.2.02 CVEs
0.3.01 CVE
0.3.11 CVE
0.4.01 CVE
0.5.01 CVE
0.5.11 CVE
0.5.21 CVE
0.6.01 CVE
0.6.11 CVE
0.7.01 CVE
2.3.11 CVE
2.4.01 CVE

Version ranges

>= 2.0.0, < 2.3.12 CVEs
2.0.0 <= v < 2.3.12 CVEs
< 0.3.01 CVE
< 2.0.11 CVE
>= 2.0.0, < 2.0.11 CVE
>= 2.0.0, < 2.4.11 CVE
0.2.0 <= v <= 0.2.01 CVE
2.0.0 <= v < 2.4.11 CVE

Fixed in

2.3.12 CVEs
b38d91fdbc69dfe31fe9230d97dafe527ea854a02 CVEs
2.0.11 CVE
2.4.11 CVE
d361e2ea24e427581343dee5c7a32b485d79fcc01 CVE
ed6788e710fc3093a7ecc2d078bf734c0f200d8d1 CVE
edc30b474f5afd4cc603e17149704d5aa605151d1 CVE
f36420caba9edbfdfd64f95a9554c0836d9cf8191 CVE

Find a version

5 CVEs

Sort

go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names
CVE-2026-24686
Public exploit
Patch
CWE-22
Medium · CVSS 4.7
EPSS 0.2% (12th pct)2026-01-27
go-tuf improperly validates the configured threshold for delegations
CVE-2026-23992
Patch
CWE-347
High · CVSS 7.5
EPSS 0.2% (10th pct)2026-01-22
go-tuf affected by client DoS via malformed server response
CVE-2026-23991
Patch
CWE-754
High · CVSS 7.5
EPSS 0.5% (42th pct)2026-01-22
Incorrect delegation lookups can make go-tuf download the wrong artifact
CVE-2024-47534
Patch
CWE-362
High · CVSS 8.7
EPSS 0.5% (40th pct)2024-10-01
High vulnerability · 2022-05-05
CVE-2022-29173
Patch
CWE-354
High · CVSS 8.8
EPSS 0.6% (43th pct)2022-05-05

theupdateframework go-tuf Vulnerabilities

Overview

Severity and exploitation

Affected versions and CVEs

Specific versions

Version ranges

Fixed in

Common weakness types

Disclosure activity by year

Other theupdateframework products

Frequently asked questions

References

Track theupdateframework go-tuf vulnerabilities