tough (crates.io) — known CVEs & security advisories
Known CVE vulnerabilities and GitHub Security Advisories affecting the crates.io package tough, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.
CVE-2020-15093 — CVSS 8.6 (high): The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an…
CVE-2021-41149 — CVSS 8.2 (high): Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior…
CVE-2021-41150 — CVSS 8.2 (high): Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior…
CVE-2026-6967 — CVSS 5.9 (medium): Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote…
CVE-2026-6966 — CVSS 5.3 (medium): Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows…
CVE-2025-2886 — CVSS 4.5 (medium): Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a…
CVE-2025-2887 — CVSS 4.5 (medium): During a target rollback, the client fails to detect the rollback for delegated targets. This could cause the client to fetch a target from…
CVE-2025-2888 — CVSS 4.5 (medium): During a snapshot rollback, the client incorrectly caches the timestamp metadata. If the client checks the cache when attempting to perform…
CVE-2025-2885 — CVSS 4.5 (medium): Missing validation of the root metatdata version number could allow an actor to supply an arbitrary version number to the client instead of…