CVE-2025-2886

Description

Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a terminating delegation. This could cause the client to fetch a target from an incorrect source, altering the target contents. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Reserved 2025-03-27 | Published 2025-03-27 | Updated 2025-03-28 | Assigner AMZN

Problem types

CWE-670 Always-Incorrect Control Flow Implementation

Product status

Default status
unaffected

0.1.0 before 0.20.0
affected

References

github.com/.../tough/security/advisories/GHSA-v4wr-j3w6-mxqc

aws.amazon.com/security/security-bulletins/AWS-2025-007/

cve.org (CVE-2025-2886)

nvd.nist.gov (CVE-2025-2886)

Download JSON