CVE-2026-25934
MediumCVSS 4.3Summary
go-git is a pure Go git implementation library. Prior to 5.16.5, a vulnerability was discovered where data integrity values for .pack and .idx files were not properly verified, potentially leading to consumption of corrupted files and unexpected errors such as object not found. Clients fetch packfiles from upstream Git servers containing checksums, but go-git did not verify them correctly.
Risk Assessment
The organization may encounter errors and potentially process corrupted data during git operations, leading to repository inconsistencies or application failures. No direct code execution was observed, but data integrity is at risk.
Recommendation
Update go-git to version 5.16.5 or later. Ensure all applications using go-git are rebuilt with the fixed library.
Other vulnerabilities in go-git
See all- CVE-2026-41506Medium
go-git is a pure Go git implementation library. Prior to versions 5.18.0 and 6.0.0-alpha.2, it may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.
- CVE-2026-71557Medium
go-git is a git implementation library in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths, so a maliciously crafted reference name can cause writes outside the intended directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.
- CVE-2026-71556High
go-git prior to versions 5.19.2 and 6.0.0-alpha.5 has a vulnerability where worktree operations (checkout, status, add) resolve symbolic links without confining resolution to the worktree boundary. A maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory.
- CVE-2026-34165Medium
In the go-git library (pure Go git implementation) versions 5.0.0 to before 5.17.1, a maliciously crafted .idx file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a denial-of-service (DoS) condition. Exploitation requires write access to the local repository's .git directory. This issue has been patched in version 5.17.1.
- CVE-2026-33762Low
go-git is a pure Go Git implementation library. Prior to version 5.17.1, the index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing. This issue only affects Git index format version 4; earlier formats (v2 and v3) are not vulnerable.
Original NVD description (English source)
go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS