Skip to content
OpenAdvisories

Package · PyPI

tuf

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.0
    CVE-2026-123806

    tuf has platform-dependent delegation path matching

    python-tuf is a Python reference implementation of The Update Framework (TUF). Prior to 7.0.0, DelegatedRole._is_target_in_pathpattern in tuf/api/_payload.py uses fnmatch.fnmatch, which applies os.path.normcase before matching and makes delegation path author…

    theupdateframework python-tuf datadog-agent-7.77-core-integrations datadog-agent-7.78-core-integrations Ubuntu Wolfi PyPI
  • Medium 4.0
    GHSA-qp9x-wp8f-qgjj

    tuf has platform-dependent delegation path matching

    `DelegatedRole._is_target_in_pathpattern` uses `fnmatch.fnmatch` to decide whether a given target path is authorized by a delegation's glob pattern. Python's `fnmatch.fnmatch` calls `os.path.normcase()` on both arguments before matching. On POSIX hosts `normc…

    tuf PyPI
  • Medium 5.3
    CVE-2020-6173

    Client Denial of Service on TUF

    TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.

    tuf PyPI