CVE-2025-2888 Improper timestamp caching during snapshot rollback in tough

What is CVE-2025-2888?

CVE-2025-2888 is a medium-severity denial of service vulnerability in AWS tough, published on 27 Mar 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

During a snapshot rollback, the client incorrectly caches the timestamp metadata. If the client checks the cache when attempting to perform the next update, the update timestamp validation will fail, preventing the next update until the cache is cleared. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Weakness: CWE-1025

Which versions are affected by CVE-2025-2888?

2 open source packages ship an affected version, including tough. It affects 1 product.

Products include Amazon Tough.

How do I fix CVE-2025-2888?

Upgrade tough to 0.20.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-2888 being exploited?

There is no known exploitation of CVE-2025-2888 in the wild and no public exploit code.

Other vulnerabilities in AWS tough

• CVE-2020-15093 Improper verification of signature threshold in tough High 8.6
• CVE-2021-41149 Improper sanitization of target names in tough High 8.2
• CVE-2021-41150 Improper sanitization of delegated role names in tough High 8.2
• CVE-2026-6967 Missing Delegated Metadata Validation in awslabs/tough High 7.1
• CVE-2026-6968 Multiple Path Traversal Variants in awslabs/tough High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-76g3-38jv-wxh4.