go‑tuf allows a client to crash when it receives TUF metadata that is syntactically valid JSON but does not conform to the TUF metadata schema. The panic occurs during parsing before any signature validation, so an attacker who can control a repository, mirror, or cache can cause any downstream client to terminate, interrupting service availability. The weakness is a control flow bypass (CWE‑617) combined with a safety constraint violation (CWE‑754).

The vulnerability affects the Go implementation of The Update Framework shipped from version 2.0.0 through 2.3.0. Version 2.3.1 includes the fix. All installations in this range that rely on the vulnerable versions are impacted; the product is maintained by the Update Framework project under the name go‑tuf.

The CVSS score of 5.9 indicates a moderate impact, and the EPSS value of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply malformed metadata to a client that retrieves data from a repository or mirror controlled by the attacker. The attack vector is network‑based, but the effect is a local DoS against the client process. Because no signature validation occurs before the panic, the attacker does not need any signing keys to succeed.