CVE-2025-2885 Root metadata version not validated in tough

What is CVE-2025-2885?

CVE-2025-2885 is a medium-severity vulnerability in AWS tough, published on 27 Mar 2025.

Official description

Missing validation of the root metatdata version number could allow an actor to supply an arbitrary version number to the client instead of the intended version in the root metadata file, altering the version fetched by the client. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Weakness: CWE-1288

Which versions are affected by CVE-2025-2885?

2 open source packages ship an affected version, including tough. It affects 1 product.

Products include Amazon Tough.

How do I fix CVE-2025-2885?

Upgrade tough to 0.20.0 or later.

Is CVE-2025-2885 being exploited?

There is no known exploitation of CVE-2025-2885 in the wild and no public exploit code.

Other vulnerabilities in AWS tough

• CVE-2020-15093 Improper verification of signature threshold in tough High 8.6
• CVE-2021-41149 Improper sanitization of target names in tough High 8.2
• CVE-2021-41150 Improper sanitization of delegated role names in tough High 8.2
• CVE-2026-6967 Missing Delegated Metadata Validation in awslabs/tough High 7.1
• CVE-2026-6968 Multiple Path Traversal Variants in awslabs/tough High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5vmp-m5v2-hx47.