CVE-2025-2886

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-2886
Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a terminating delegation. This could cause the client to fetch a target from an incorrect source, altering the target contents. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

4.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://aws.amazon.com/security/security-bulletins/AWS-2025-007/ Vendor Advisory
https://github.com/awslabs/tough/releases/tag/tough-v0.20.0
https://github.com/awslabs/tough/security/advisories/GHSA-v4wr-j3w6-mxqc Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:amazon:tough:*:*:*:*:*:rust:*:*
History

14 Oct 2025, 19:15

Type Values Removed Values Added
References
  • () https://github.com/awslabs/tough/releases/tag/tough-v0.20.0 -

19 Sep 2025, 14:31

Type Values Removed Values Added
References () https://aws.amazon.com/security/security-bulletins/AWS-2025-007/ - () https://aws.amazon.com/security/security-bulletins/AWS-2025-007/ - Vendor Advisory
References () https://github.com/awslabs/tough/security/advisories/GHSA-v4wr-j3w6-mxqc - () https://github.com/awslabs/tough/security/advisories/GHSA-v4wr-j3w6-mxqc - Vendor Advisory
Summary
  • (es) La falta de validación de la delegación final hace que el cliente continúe buscando en la lista de delegaciones definidas, incluso después de buscar una delegación final. Esto podría provocar que el cliente obtenga un destino de una fuente incorrecta, alterando su contenido. Los usuarios deben actualizar a la versión 0.20.0 o posterior y asegurarse de que cualquier código bifurcado o derivado esté parcheado para incorporar las nuevas correcciones.
First Time Amazon
Amazon tough
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.5
CPE cpe:2.3:a:amazon:tough:*:*:*:*:*:rust:*:*

27 Mar 2025, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-27 23:15

Updated : 2025-10-14 19:15

NVD link : CVE-2025-2886

Mitre link : CVE-2025-2886

CVE.ORG link : CVE-2025-2886

JSON object : View

Products Affected

amazon

  • tough
CWE
CWE-670

Always-Incorrect Control Flow Implementation