CVE-2026-41506

go-git is a pure Go git implementation library. Prior to 5.16.5, a vulnerability was discovered where data integrity values for .pack and .idx files were not properly verified, potentially leading to consumption of corrupted files and unexpected errors such as object not found. Clients fetch packfiles from upstream Git servers containing checksums, but go-git did not verify them correctly.

go-git is a git implementation library in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths, so a maliciously crafted reference name can cause writes outside the intended directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.

go-git prior to versions 5.19.2 and 6.0.0-alpha.5 has a vulnerability where worktree operations (checkout, status, add) resolve symbolic links without confining resolution to the worktree boundary. A maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory.

In the go-git library (pure Go git implementation) versions 5.0.0 to before 5.17.1, a maliciously crafted .idx file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a denial-of-service (DoS) condition. Exploitation requires write access to the local repository's .git directory. This issue has been patched in version 5.17.1.

go-git is a pure Go Git implementation library. Prior to version 5.17.1, the index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing. This issue only affects Git index format version 4; earlier formats (v2 and v3) are not vulnerable.