AWS patches security flaws in tough library and tuftool CLI utility

Amazon Web Services published security bulletin 2026-019-AWS on April 24, 2026, disclosing multiple security issues within its tough library and tuftool command-line interface utility. The advisory, categorized as requiring attention, mandates immediate action for users of these tools to mitigate potential risks associated with repository management operations.

The tough library is a Rust-based component used for generating, signing, and managing The Update Framework (TUF) repositories. The tuftool utility serves as the command-line interface for these repository management tasks. AWS stated that the identified issues have been addressed in specific updated versions, urging users to apply the fixes without delay to secure their infrastructure.

Context and background

The security issues affect a wide range of historical versions for both components. Specifically, the tough library versions 0.1.0 through 0.21.x are vulnerable. Similarly, tuftool versions 0.1.0 through 0.14.x are impacted by these flaws. AWS confirmed that the fixes are available in tough version 0.22.0 and later, as well as tuftool version 0.15.0 and later.

AWS credited Emily Albini of Oxide Computer Company and Oleh Konko of 1seal.org for their collaboration in identifying and reporting these issues. The researchers worked through the coordinated disclosure process to ensure the vulnerabilities were addressed before public release. AWS thanked them for their contribution to the security of the ecosystem.

Who is affected

Any organization or individual using the tough library or tuftool utility for TUF repository management is potentially affected. This includes users who have forked or derived code from these libraries. AWS explicitly recommended that users review and update any forked or derivative code to incorporate the necessary security fixes. Failure to update may leave systems exposed to the identified issues.

The bulletin emphasizes that there are no known workarounds for these vulnerabilities. Upgrading to the patched versions is the only confirmed method to resolve the issues. AWS noted that the scope of the bulletin applies to AWS content, but the libraries themselves are open-source tools widely used in software supply chain security.

What should you do?

Administrators should immediately audit their systems to identify any installations of the tough library or tuftool utility. If any affected versions are present, they must be upgraded to the minimum secure versions specified by AWS. Organizations using custom forks of these tools should integrate the security patches from the official releases into their codebases.

What to do and how to stay safe: AWS

• Inventory all systems using the tough library or tuftool utility to determine current version numbers.
• Upgrade the tough library to version 0.22.0 or higher and tuftool to version 0.15.0 or higher.
• Review any forked or derivative code to ensure it incorporates the latest security fixes from the official releases.
• Monitor official channels for further updates or additional security advisories related to these components.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of the tough library are affected by these security issues?

Versions 0.1.0 through 0.21.x of the tough library are affected by the security issues identified in bulletin 2026-019-AWS.

Are there any workarounds for these vulnerabilities?

No, AWS stated there are no known workarounds for these issues, and upgrading to the patched versions is required.

Who discovered these security issues?

Emily Albini of Oxide Computer Company and Oleh Konko of 1seal.org collaborated on the disclosure of these issues.