CVE-2026-33762
LowCVSS 2.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
go-git is a pure Go Git implementation library. Prior to version 5.17.1, the index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing. This issue only affects Git index format version 4; earlier formats (v2 and v3) are not vulnerable.
Risk Assessment
An attacker can cause a crash in applications using go-git to parse a malicious index file, leading to denial of service (DoS).
Recommendation
Update go-git to version 5.17.1 or later.
Other vulnerabilities in go-git
See all- CVE-2026-41506Medium
go-git is a pure Go git implementation library. Prior to versions 5.18.0 and 6.0.0-alpha.2, it may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.
- CVE-2026-25934Medium
go-git is a pure Go git implementation library. Prior to 5.16.5, a vulnerability was discovered where data integrity values for .pack and .idx files were not properly verified, potentially leading to consumption of corrupted files and unexpected errors such as object not found. Clients fetch packfiles from upstream Git servers containing checksums, but go-git did not verify them correctly.
- CVE-2026-71557Medium
go-git is a git implementation library in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths, so a maliciously crafted reference name can cause writes outside the intended directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.
- CVE-2026-71556High
go-git prior to versions 5.19.2 and 6.0.0-alpha.5 has a vulnerability where worktree operations (checkout, status, add) resolve symbolic links without confining resolution to the worktree boundary. A maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory.
- CVE-2026-34165Medium
In the go-git library (pure Go git implementation) versions 5.0.0 to before 5.17.1, a maliciously crafted .idx file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a denial-of-service (DoS) condition. Exploitation requires write access to the local repository's .git directory. This issue has been patched in version 5.17.1.
Original NVD description (English source)
go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing. This issue only affects Git index format version 4. Earlier formats (go-git supports only v2 and v3) are not vulnerable to this issue. This issue has been patched in version 5.17.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS