HIGH7.5Go
GHSA-4f8r-qqr9-fq8j· CVE-2024-47534, GO-2024-3166Incorrect delegation lookups can make go-tuf download the wrong artifact
Modified: 9/10/2026
package
Go/github.com/theupdateframework/go-tuf/v2
pkg:go/github.com/theupdateframework/go-tuf/v2
MEDIUM5.9Go
GHSA-846p-jg2w-w324· CVE-2026-23991, GO-2026-4348go-tuf affected by client DoS via malformed server response
Modified: 9/10/2026
MEDIUM5.9Go
GHSA-fphv-w9fq-2525· CVE-2026-23992, GO-2026-4349go-tuf improperly validates the configured threshold for delegations
Modified: 9/10/2026
MEDIUM4.7Go
GHSA-jqc5-w2xx-5vq4· CVE-2026-24686, GO-2026-4377go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names
Modified: 9/10/2026
—Go
GO-2024-3166· CVE-2024-47534, GHSA-4f8r-qqr9-fq8jIncorrect delegation lookups can make go-tuf download the wrong artifact in github.com/theupdateframework/go-tuf
Modified: 2/4/2026
—Go
GO-2026-4348· CVE-2026-23991, GHSA-846p-jg2w-w324Client DoS via malformed server response in github.com/theupdateframework/go-tuf
Modified: 8/7/2026
—Go
GO-2026-4349· CVE-2026-23992, GHSA-fphv-w9fq-2525Improper validattion of configured threshold for delegations in github.com/theupdateframework/go-tuf
Modified: 2/26/2026
—Go
GO-2026-4377· CVE-2026-24686, GHSA-jqc5-w2xx-5vq4Path traversal in TAP 4 multirepo client allows arbitrary file write via repo names in github.com/theupdateframework/go-tuf
Modified: 2/26/2026