debian/golang-github-go-git-go-git vulnerabilities

Latest debian/golang-github-go-git-go-git CVEs

Newest publication first

1. CVE-2026-71557 go-git: Malicious reference names may modify files outside the reference storage

   Published 2026-08-07

   Medium·CVSS 6.3 EPSS 0.41%

   go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example con...

2. CVE-2026-71556 go-git: Worktree operations may follow symlinks

   Published 2026-08-07

   High·CVSS 7.1 EPSS 0.36%

   go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a malicious...

3. CVE-2026-45570 go-git: Improper single-quote escaping in go-git SSH transport

   Published 2026-05-27

   Low·CVSS 2.3 EPSS 0.37%

   go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. A reposito...

4. CVE-2026-45571 go-git: Crafted repositories may modify main and submodule .git directories

   Published 2026-05-27

   Medium·CVSS 5.4 EPSS 0.30%

   go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could allow crafted repository data to affect files outside the intended checkout target, including the repository's .git directory. These v...

5. CVE-2026-45022 go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git

   Published 2026-05-27

   High·CVSS 7.0 EPSS 0.16%

   go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-git’s decoded representa...

6. CVE-2026-41506 go-git Credential leak via cross-host redirect in smart HTTP transport

   Published 2026-05-08

   High·CVSS 7.4 EPSS 0.26%

   go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0...

7. CVE-2026-33762 go-git: Missing validation decoding Index v4 files leads to panic

   Published 2026-03-31

   Low·CVSS 2.8 EPSS 0.18%

   go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can t...

8. CVE-2026-34165 go-git: Maliciously crafted idx file can cause asymmetric memory consumption

   Published 2026-03-31

   Medium·CVSS 5.0 EPSS 0.15%

   go-git is an extensible git implementation library written in pure Go. From version 5.0.0 to before version 5.17.1, a vulnerability has been identified in which a maliciously crafted .idx file can cause asymmetric memory consumption, potentially exhausting available memory and re...

9. CVE-2026-25934 go-git improperly verifies data integrity values for .idx and .pack files

   Published 2026-02-09

   Medium·CVSS 4.3 EPSS 0.16%

   go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files,...

10. CVE-2025-21614 go-git clients vulnerable to DoS via maliciously crafted Git server replies

    Published 2025-01-06

    High·CVSS 7.5 EPSS 0.72%

    go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted respons...

11. CVE-2025-21613 go-git has an Argument Injection via the URL field

    Published 2025-01-06

    Critical·CVSS 9.2 EPSS 1.3%

    go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flag...

12. CVE-2023-49569 Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients

    Published 2024-01-12

    Critical·CVSS 9.8 EPSS 1.5%

    A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved. Applications are only affected if they are...

13. CVE-2023-49568 Maliciously crafted Git server replies can cause DoS on go-git clients

    Published 2024-01-12

    High·CVSS 7.5 EPSS 0.70%

    A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Ap...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.