Advisory Database
  • Advisories
  • Dependency Scanning
  1. cargo
  2. ›
  3. tough
  4. ›
  5. CVE-2025-2886

CVE-2025-2886: tough terminating targets role delegations are not respected

March 28, 2025 (updated October 14, 2025)

Delegations are a mechanism defined by the TUF specification that allow multiple different identities to provide and sign content within a single repository. Terminating delegations and delegation priority give a TUF repository unambiguous control over how overlapping delegations are resolved. tough erroneously will not terminate a search as required, and will accept information from a lower-priority delegation that should have been ignored.

References

  • aws.amazon.com/security/security-bulletins/AWS-2025-007
  • github.com/advisories/GHSA-v4wr-j3w6-mxqc
  • github.com/awslabs/tough
  • github.com/awslabs/tough/commit/598111f88105a707ee68b0fa06c52da7176ea96a
  • github.com/awslabs/tough/releases/tag/tough-v0.20.0
  • github.com/awslabs/tough/security/advisories/GHSA-v4wr-j3w6-mxqc
  • nvd.nist.gov/vuln/detail/CVE-2025-2886

Code Behaviors & Features

Detect and mitigate CVE-2025-2886 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions before 0.20.0

Fixed versions

  • 0.20.0

Solution

Upgrade to version 0.20.0 or above.

Impact 4.5 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N

Learn more about CVSS

Weakness

  • CWE-670: Always-Incorrect Control Flow Implementation

Source file

cargo/tough/CVE-2025-2886.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 08 Nov 2026 00:15:55 +0000.