CVE-2026-23991

CVE-2026-23991 is a denial-of-service vulnerability affecting go-tuf versions 2.0.0 through 2.3.0. A compromised TUF repository, mirror, or cache can supply malformed (but valid JSON) TUF metadata, causing the client to panic during parsing before signature validation. This is a high-severity vulnerability (CVSS 7.5) with a network attack vector and low attack complexity, allowing unauthenticated attackers to cause a denial of service. There is no known active exploitation, public exploit code, or KEV entry, but it has garnered significant community discussion and media coverage, indicating awareness.