Uncontrolled Recursion Affecting tough package, versions <0.20.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Uncontrolled Recursion vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-RUST-TOUGH-9667377
- published6 Apr 2025
- disclosed28 Mar 2025
- creditJussi Kukkonen, AdamKorcz
Introduced: 28 Mar 2025
CVE NOT AVAILABLE CWE-674 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade tough to version 0.20.0 or higher.
Overview
tough is an Update Framework (TUF) repository client
Affected versions of this package are vulnerable to Uncontrolled Recursion in lib.rs, which does not adequately detect and avoid cyclic delegation graphs. An attacker can cause the process to abort with malicious delegation graph input.