VULNERABILITY INTELLIGENCE

CVE-2025-2888

CVSS score4.5 MEDIUM
EPSS probability0.33%
CISA KEVNot currently listed
Published2025-03-27
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N

Description

During a snapshot rollback, the client incorrectly caches the timestamp metadata. If the client checks the cache when attempting to perform the next update, the update timestamp validation will fail, preventing the next update until the cache is cleared. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Weakness classification

  • ff89ba41-3aa1-4d27-914a-91399e9639e5: CWE-1025

Primary references