Skip to main content
cve.nowby Sazabi
← crates.io
crates.ioPackage

tough

9 known vulnerabilities (3 high, 6 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
9 · 3 high, 6 medium
Registry
crates.io

Advisories 9

  • CVE-2026-6967Medium 5.9

    Missing Delegated Metadata Validation in awslabs/tough

    Affected: from 0.9.0, fixed in 0.22.0.

  • CVE-2026-6966Medium 5.3

    Signature Threshold Bypass in awslabs/tough Delegated Roles

    Affected: fixed in 0.22.0.

  • CVE-2025-2888Medium 5.7

    Improper timestamp caching during snapshot rollback in tough

    Affected: fixed in 0.20.0.

  • CVE-2025-2887Medium 5.7

    Failure to detect delegated target rollback in tough

    Affected: fixed in 0.20.0.

  • CVE-2025-2886Medium 5.7

    Terminating targets role delegations are not respected in tough

    Affected: fixed in 0.20.0.

  • CVE-2025-2885Medium 5.7

    Root metadata version not validated in tough

    Affected: fixed in 0.20.0.

  • Improper sanitization of delegated role names in tough

    Affected: fixed in 0.12.0.

  • Improper sanitization of target names in tough

    Affected: fixed in 0.12.0.

  • Improper verification of signature threshold in tough

    Affected: fixed in 0.7.1; fixed in 0.7.1.