https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 15:05:00 +0000 https://vulnerability.circl.lu/vuln/ghsa-846p-jg2w-w324 <p><strong>Affected:</strong> Go: github.com/theupdateframework/go-tuf/v2</p> <p># Security Disclosure: Client DoS via malformed server response</p> <p>## Summary</p> <p>If the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic _during parsing_, causing a DoS. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key.</p> <p>## Impact</p> <p>Client crashes upon receiving and parsing malformed TUF metadata. This can cause long running services to enter an restart/crash loop.</p> <p>## Workarounds</p> <p>None currently.</p> <p>## Affected code</p> <p>The `metadata.checkType` function did not properly type assert the (untrusted) input causing it to panic on malformed data.</p> <p><strong>Affected:</strong> Go: github.com/theupdateframework/go-tuf/v2</p> <p># Security Disclosure: Client DoS via malformed server response</p> <p>## Summary</p> <p>If the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic _during parsing_, causing a DoS. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key.</p> <p>## Impact</p> <p>Client crashes upon receiving and parsing malformed TUF metadata. This can cause long running services to enter an restart/crash loop.</p> <p>## Workarounds</p> <p>None currently.</p> <p>## Affected code</p> <p>The `metadata.checkType` function did not properly type assert the (untrusted) input causing it to panic on malformed data.</p> https://vulnerability.circl.lu/vuln/ghsa-846p-jg2w-w324