VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/theupdateframework/go-tuf: vulnerability history, versions and safety

github.com/theupdateframework/go-tuf is a package in the Go ecosystem. Vulert records 8 vulnerabilities for it across 120 releases, from May 2022 to Feb 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
8 vulnerabilities recorded H1 L1 U6
i
3 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
3 in the last 12 months

Most recent disclosure 02 Feb 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/theupdateframework/go-tuf vulnerabilities

Vulert verdict on github.com/theupdateframework/go-tuf v0.7.0 i

Updated on 23 Oct 2026

Careful: v0.7.0 has 8 known vulnerabilities, and 3 have no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 60/100
  • Security Some issues to review
  • Maintenance Maintaining
  • Popularity Widely used
  • Community Moderate

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v0.7.0 — affected i
  • Vulnerabilities on record 8 over 3 years · 3 in the last year i
  • Latest disclosure 02 Feb 2026 i
  • Highest CVSS 8.0 i
  • With no published fix 3 i
  • Stars 720 i
  • OpenSSF scorecard 6/10 i
  • Last release 34 months ago i
  • Licence BSD-3-Clause i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/theupdateframework/go-tuf, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20240124125847-32712b6d3c14 24 Jan 2024 H1 L1 U6 BSD-3-Clause No Details →
v0.7.1-0.20240119175125-08948c706fab 19 Jan 2024 H1 L1 U6 BSD-3-Clause No Details →
v0.7.1-0.20240116141818-3dd2ccac05e1 16 Jan 2024 H1 L1 U6 BSD-3-Clause No Details →
v0.7.1-0.20231206102608-053c629952b7 06 Dec 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.7.1-0.20231204175731-abd7bf37b617 04 Dec 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.7.1-0.20231201184526-3981333b27b6 01 Dec 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.7.0 28 Nov 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.6.2-0.20231106160315-17b62053f271 06 Nov 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.6.2-0.20231020145536-2258ee127fcb 20 Oct 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.6.2-0.20231017135728-ca61fb042faf 17 Oct 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.6.2-0.20231012134808-58f321a3484c 12 Oct 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.6.2-0.20231010192554-9570146bb95f 10 Oct 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.6.2-0.20230919202611-35c71e42cd12 19 Sep 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.6.2-0.20230916160643-70d3a5483ff5 16 Sep 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.6.2-0.20230915083604-14ed751bc4d0 15 Sep 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.6.2-0.20230911222228-1f8a2d8c5bfa 11 Sep 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.6.2-0.20230905181310-3a5077742dec 05 Sep 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.6.2-0.20230821163218-fe99435ce462 21 Aug 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.6.2-0.20230815133653-3ff5aa787126 15 Aug 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.6.1 11 Aug 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.6.1-0.20230811110953-ca0c316673ca 11 Aug 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.6.1-0.20230810152207-ad706edfd9d1 10 Aug 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.6.1-0.20230725203721-4e4f7f3c2772 25 Jul 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230719084944-9774d7980aae 19 Jul 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.6.0 19 Jul 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230717151607-e2f53d95b2c9 17 Jul 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230711021325-5ed62397581b 11 Jul 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230706222816-4b9fd323aeb3 06 Jul 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230705131838-6aa3072403d1 05 Jul 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230705021520-6adc1956b94a 05 Jul 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230703150414-31dbaeca867d 03 Jul 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230630072814-f21355ba2c73 30 Jun 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230620151510-2adcfe74e69d 20 Jun 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230613173229-c844873524cc 13 Jun 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230607154608-0bf668e1a683 07 Jun 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230605175110-c95b55348818 05 Jun 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230602143741-6e5284c5ecf6 02 Jun 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230601221041-1f98392022b4 01 Jun 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230526022819-a41f2d25edc6 26 May 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230523161525-401f689281d6 23 May 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230522194915-d1450a59a5a6 22 May 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230518135122-ed58d45ef6ce 18 May 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230508161414-56698a36ec66 08 May 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230427154529-e077a6808a51 27 Apr 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230427153208-8edc996a2130 27 Apr 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230424150929-c79b5e65c76a 24 Apr 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230419171018-6b93a5ad22c2 19 Apr 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230408171605-c7d649bb1892 08 Apr 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230407140617-ab35782b3512 07 Apr 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230324203418-7cddf5836cb1 24 Mar 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230320173506-7f231b3d8147 20 Mar 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230316145405-493ab6cae589 16 Mar 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230306152125-ba794d1d5f4a 06 Mar 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230227153811-c386074f970f 27 Feb 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230213161353-fab805a8e00b 13 Feb 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.3-0.20230131152842-2cea368d2bf2 31 Jan 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.2 24 Jan 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.2-0.20230117155912-2b213572f605 17 Jan 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.2-0.20230113161139-8f585b5ce1b0 13 Jan 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.2-0.20230111154207-a6e32beded45 11 Jan 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.2-0.20230111115752-3889ddd0b8be 11 Jan 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.2-0.20230109155651-7e8644179b40 09 Jan 2023 H1 L1 U6 BSD-3-Clause No Details →
v0.5.2-0.20221207161717-9cb61d6e65f5 07 Dec 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.5.2-0.20221202173518-c803c816c706 02 Dec 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.5.2-0.20221116143715-00e8129a6d46 16 Nov 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.5.2-0.20221115152800-535756abf049 15 Nov 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.5.2-0.20221114162133-901213da55cd 14 Nov 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.5.2-0.20221104082613-2ac63f72c7df 04 Nov 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.5.2-0.20221024184101-64bd8051f804 24 Oct 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.5.2-0.20221021130219-7d83cf28176c 21 Oct 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.5.2-0.20221018171143-fff5e69bbaf9 18 Oct 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.5.2-0.20221014142014-39613e37d474 14 Oct 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.0.0-20221007222135-0f8d7fe3afaf 07 Oct 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.5.2-0.20221005180633-adbdc7d5f696 05 Oct 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.5.2-0.20221003190450-b4b954d5250b 03 Oct 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.5.2-0.20220930112810-3890c1e7ace4 30 Sep 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.5.2-0.20220927174049-f75cbcc8550d 27 Sep 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.5.1 21 Sep 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.5.1-0.20220920170306-f237d7ca5b42 20 Sep 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.5.1-0.20220920160848-040092c44a08 20 Sep 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.0.0-20220914171043-13eff30efd6c 14 Sep 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.5.1-0.20220914171043-13eff30efd6c 14 Sep 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.0.0-20220913162901-7097fd8d6ee0 13 Sep 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.5.1-0.20220913162901-7097fd8d6ee0 13 Sep 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.5.0 07 Sep 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.3.2 06 Sep 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.4.0 06 Sep 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.3.2-0.20220902210436-64ded1864de9 02 Sep 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.3.2-0.20220829140004-ac7b5d7bce18 29 Aug 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.3.2-0.20220826173546-d7ff71b6b12e 26 Aug 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.3.2-0.20220825151611-9b6c50301652 25 Aug 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.3.2-0.20220822140834-ebbc6b8d12d8 22 Aug 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.0.0-20220805174735-f3a48f74a347 05 Aug 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.3.2-0.20220805174735-f3a48f74a347 05 Aug 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.0.0-20220805173406-8b2d2abc064c 05 Aug 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.3.2-0.20220805173406-8b2d2abc064c 05 Aug 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.3.2-0.20220805145800-8124e8ab6c86 05 Aug 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.3.2-0.20220804154505-1b070ee8b8b1 04 Aug 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.0.0-20220803194903-768b63a55366 03 Aug 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.3.2-0.20220803194903-768b63a55366 03 Aug 2022 H1 L1 U6 BSD-3-Clause No Details →
v0.0.0-20220803125437-2b415d0f0043 03 Aug 2022 H1 L1 U6 — No Details →
v0.3.2-0.20220803125437-2b415d0f0043 03 Aug 2022 H1 L1 U6 — No Details →
v0.3.2-0.20220726085436-37601e1635fd 26 Jul 2022 H1 L1 U6 — No Details →
v0.0.0-20220720135945-4febe4c81aa1 20 Jul 2022 H1 L1 U6 — No Details →
v0.3.2-0.20220720135945-4febe4c81aa1 20 Jul 2022 H1 L1 U6 — No Details →
v0.3.2-0.20220720095452-2e6c62191fb2 20 Jul 2022 H1 L1 U6 — No Details →
v0.3.2-0.20220719140508-af3c7d6a7dff 19 Jul 2022 H1 L1 U6 — No Details →
v0.3.2-0.20220715102257-9334b3fef99a 15 Jul 2022 H1 L1 U6 — No Details →
v0.3.2-0.20220714165121-9020b3c884ca 14 Jul 2022 H1 L1 U6 — No Details →
v0.3.2-0.20220712133948-9d0031b6e8ba 12 Jul 2022 H1 L1 U6 — No Details →
v0.3.2-0.20220712133157-40b67d26c825 12 Jul 2022 H1 L1 U6 — No Details →
v0.3.2-0.20220708134402-0f1723639488 08 Jul 2022 H1 L1 U6 — No Details →
v0.3.2-0.20220706212127-f5f12b16b426 06 Jul 2022 H1 L1 U6 — No Details →
v0.3.2-0.20220705155236-529fccafdd0d 05 Jul 2022 H1 L1 U6 — No Details →
v0.3.1 30 Jun 2022 H1 L1 U6 — No Details →
v0.3.1-0.20220630194227-0d40b25637fa 30 Jun 2022 H1 L1 U6 — No Details →
v0.3.1-0.20220630180555-eed9e6c4d8ea 30 Jun 2022 H1 L1 U6 — No Details →
v0.3.1-0.20220630160650-3bb077e8c246 30 Jun 2022 H1 L1 U6 — No Details →
v0.3.1-0.20220623220127-e3efe988f037 23 Jun 2022 H1 L1 U6 — No Details →
v0.3.1-0.20220622095213-439ce47c43c7 22 Jun 2022 H1 L1 U6 — No Details →

The newest 120 of 423 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2022 5
  • 2026 3

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 3 of the 8 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/theupdateframework/go-tuf

The 5 most severe of 8 vulnerabilities recorded for this package

Search all 8 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2022-29173: Improper Validation of Integrity Check Value in go-tuf 8.0 high 0.3.0 24 May 2022
CVE-2022-29173: Improper Validation of Integrity Check Value in go-tuf N/A unrated 0.3.0 01 Jul 2022
CVE-2022-29173: Version rollback attack in github.com/theupdateframework/go-tuf N/A unrated 0.3.0 01 Jul 2022
Improper handling of different key IDs in go-tuf metadata N/A low 0.3.2 16 Sep 2022
CVE-2022-1004: Improper handling of keys in go-tuf N/A unrated 0.3.2 21 Sep 2022

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/theupdateframework/go-tuf

Is github.com/theupdateframework/go-tuf safe to use?

Vulert records 8 vulnerabilities for github.com/theupdateframework/go-tuf in Go: 0 critical, 1 high, 0 medium and 1 low, plus 6 not yet rated. 3 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/theupdateframework/go-tuf's Vulert package health score?

Vulert scores github.com/theupdateframework/go-tuf 60/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/theupdateframework/go-tuf affected?

Yes. v0.7.0, the version you would install today, has 8 known vulnerabilities, and 3 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

Which version of github.com/theupdateframework/go-tuf should I use?

v0.7.0 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/theupdateframework/go-tuf have?

8 vulnerabilities are recorded for github.com/theupdateframework/go-tuf in the Go ecosystem: 0 critical, 1 high, 0 medium and 1 low, plus 6 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/theupdateframework/go-tuf vulnerabilities disclosed?

3 vulnerabilities were recorded for github.com/theupdateframework/go-tuf in the last 12 months, and the oldest entry in this database dates to 24 May 2022. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/theupdateframework/go-tuf are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/theupdateframework/go-tuf for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/theupdateframework/go-tuf version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.