Skip to content
Heist/ feed
Back to feed
Medium

Terminating targets role delegations are not respected in tough

Type: advisorySources: OSV

Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a terminating delegation. This could cause the client to fetch a target from an incorrect source, altering the target contents. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2025-2886
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 20:19 UTC · Revision 1

Source evidence

Terminating targets role delegations are not respected in tough

core-osv · Original source

Published 27 Mar 2025, 22:22 UTC

Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a terminating delegation. This could cause the client to fetch a target from an incorrect source, altering the target contents. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

osv:CVE-2025-2886
Complete source record
{
  "id": "8ffec5f4ede438eac702d4deb7a36fddc8e939f7b810d1e740307b1a32132a6f",
  "url": "https://osv.dev/vulnerability/CVE-2025-2886",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Terminating targets role delegations are not respected in tough",
    "summary": "Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a terminating delegation. This could cause the client to fetch a target from an incorrect source, altering the target contents. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.",
    "evidence": "osv:CVE-2025-2886",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2025-2886",
      "aliases": [
        "CVE-2025-2886",
        "GHSA-v4wr-j3w6-mxqc"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/awslabs/tough",
              "type": "GIT",
              "events": [
                {
                  "introduced": "9ac95c8aaf94b816393b578af247edf1af958c44"
                },
                {
                  "fixed": "596c2a046a3e5da841090a1c216bf65960dbc840"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0.1.0"
                      },
                      {
                        "fixed": "0.20.0"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "596c2a046a3e5da841090a1c216bf65960dbc840"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "tough-v0.20.0"
                  },
                  {
                    "cpe": "cpe:2.3:a:amazon:tough:*:*:*:*:*:rust:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.20.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "tuftool-v0.12.0",
            "tough-v0.19.0",
            "tough-ssm-v0.14.0",
            "tough-kms-v0.11.0",
            "olpc-cjson-v0.1.4",
            "tuftool-v0.11.1",
            "tuftool-v0.11.0",
            "tough-v0.18.0",
            "tough-ssm-v0.13.0",
            "tough-kms-v0.10.0",
            "tough-v0.17.1",
            "tuftool-v0.10.3",
            "tough-v0.17.0",
            "tough-ssm-v0.12.0",
            "tough-kms-v0.9.0",
            "tuftool-v0.10.2",
            "tough-v0.16.0",
            "tough-ssm-v0.11.0",
            "tough-kms-v0.8.0",
            "tuftool-v0.10.1",
            "tough-v0.15.0",
            "tough-ssm-v0.10.0",
            "tough-kms-v0.7.0",
            "tuftool-v0.10.0",
            "tough-v0.14.0",
            "tough-ssm-v0.9.0",
            "tough-kms-v0.6.0",
            "tuftool-v0.9.0",
            "tough-v0.13.0",
            "tough-ssm-v0.8.0",
            "tough-kms-v0.5.0",
            "olpc-cjson-v0.1.3",
            "tuftool-v0.8.2",
            "tough-v0.12.5",
            "tough-ssm-v0.7.2",
            "tough-kms-v0.4.2",
            "olpc-cjson-v0.1.2",
            "tuftool-v0.8.1",
            "tough-v0.12.4",
            "tough-ssm-v0.7.1",
            "tough-kms-v0.4.1",
            "tuftool-v0.8.0",
            "tough-v0.12.3",
            "tough-ssm-v0.7.0",
            "tough-kms-v0.4.0",
            "tuftool-v0.7.2",
            "tough-v0.12.2",
            "tough-ssm-v0.6.6",
            "tough-kms-v0.3.6",
            "tuftool-v0.7.0",
            "tough-v0.12.0",
            "tough-ssm-v0.6.4",
            "tough-kms-v0.3.4",
            "tuftool-v0.6.4",
            "tough-v0.11.3",
            "tough-ssm-v0.6.3",
            "tough-kms-v0.3.3",
            "tuftool-v0.6.3",
            "tough-v0.11.2",
            "tough-ssm-v0.6.2",
            "tough-kms-v0.3.2",
            "tuftool-v0.6.2",
            "tough-v0.11.1",
            "tough-ssm-v0.6.1",
            "tough-kms-v0.3.1",
            "olpc-cjson-v0.1.1",
            "tough-kms-v0.1.1",
            "tuftool-v0.5.0",
            "tough-v0.9.0",
            "tough-ssm-v0.4.0",
            "tough-kms-v0.1.0",
            "tuftool-v0.4.1",
            "tough-v0.8.0",
            "tough-ssm-v0.3.0",
            "tough-v0.7.0",
            "tough-ssm-v0.2.0",
            "tuftool-v0.4.0",
            "tough-ssm-v0.1.0",
            "tough-v0.6.0",
            "tough-v0.5.0",
            "tuftool-v0.3.0",
            "tough-v0.4.0",
            "tuftool-v0.2.0",
            "tough-v0.3.0",
            "tuftool-v0.1.1",
            "tough-v0.2.0",
            "tuftool-v0.1.0",
            "tough-v0.1.0",
            "olpc-cjson-v0.1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-2886.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:39.325809551Z",
      "provider": "osv",
      "references": [
        "https://aws.amazon.com/security/security-bulletins/AWS-2025-007/",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2886.json",
        "https://github.com/awslabs/tough/security/advisories/GHSA-v4wr-j3w6-mxqc",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-2886",
        "https://github.com/awslabs/tough/releases/tag/tough-v0.20.0",
        "https://github.com/awslabs/tough"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-670"
        ],
        "cna_assigner": "AMZN",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2886.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-2886",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 506600,
  "published_at": "2025-03-27T22:22:14.382+00:00"
}