https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T06:30:51.409869+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-37136 EUVD-2026-37136 2026-10-05T06:30:51.412916+00:00 EUVD-2026-37136 https://cve.radiocsirt.org/vuln/fkie_cve-2020-6173 fkie_cve-2020-6173 2026-10-05T06:30:51.412946+00:00

TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.

 https://cve.radiocsirt.org/vuln/ghsa-2828-9vh6-9m6j GHSA-2828-9vh6-9m6j — Client Denial of Service on TUF 2026-10-05T06:30:51.412975+00:00

Affected: PyPI: tuf

### Impact An attacker who can gain file access to the repository and modify metadata files may cause a denial of service to clients by creating many invalid signatures on a metadata file. Having a large number of signatures to verify will delay the moment when the client will determine the signature is not valid. This delay may be for at least a few minutes, but possibly could be longer especially if multiple files are impacted.

The tuf maintainers would like to thank Erik MacLean of Analog Devices, Inc. for reporting this issue.

### Patches No fix exists for this issue.

### Workarounds No workarounds are known for this issue.

### References * [CVE-2020-6173](https://nvd.nist.gov/vuln/detail/CVE-2020-6173) * [Issue #973](https://github.com/theupdateframework/tuf/issues/973)

 https://cve.radiocsirt.org/vuln/gsd-2020-6173 gsd-2020-6173 2026-10-05T06:30:51.413007+00:00 gsd-2020-6173 https://cve.radiocsirt.org/vuln/pysec-2020-146 PYSEC-2020-146 2026-10-05T06:30:51.413020+00:00

Affected: PyPI: tuf

TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.