go-git vulnerabilities

Products

• go-git 14
• github.com/go-git/go-billy/v5 2

Latest go-git CVEs

Newest publication first

1. CVE-2026-71557 go-git: Malicious reference names may modify files outside the reference storage

   Published 2026-08-07

   Medium·CVSS 6.3 EPSS 0.41%

   go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example con...

2. CVE-2026-71556 go-git: Worktree operations may follow symlinks

   Published 2026-08-07

   High·CVSS 7.1 EPSS 0.36%

   go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a malicious...

3. CVE-2026-44740 go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

   Published 2026-06-01

   Medium·CVSS 6.5 EPSS 0.39%

   Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise...

4. GHSA-w5pp-99ch-qj29 go-git: Malformed Git object data may cause panics or resource exhaustion

   Published 2026-05-29

   Medium·CVSS 6.5

   Impact Several denial-of-service issues were identified in go-git when parsing maliciously crafted Git repository data. An attacker may craft a malicious .pack, .idx or loose objects that causes an application using an affected version of go-git to panic or consume excessive reso...

5. CVE-2026-44973 Billy: Path traversal vulnerabilities

   Published 2026-05-28

   High·CVSS 8.1 EPSS 0.31%

   Billy is an interface filesystem abstraction for Go. Prior to 5.9.0, multiple path traversal issues exist across different components of go-billy. Insufficient path sanitization and boundary enforcement may allow crafted paths (e.g., using ..) to escape intended base directories....

6. CVE-2026-45570 go-git: Improper single-quote escaping in go-git SSH transport

   Published 2026-05-27

   Low·CVSS 2.3 EPSS 0.37%

   go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. A reposito...

7. CVE-2026-45571 go-git: Crafted repositories may modify main and submodule .git directories

   Published 2026-05-27

   Medium·CVSS 5.4 EPSS 0.30%

   go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could allow crafted repository data to affect files outside the intended checkout target, including the repository's .git directory. These v...

8. CVE-2026-45022 go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git

   Published 2026-05-27

   High·CVSS 7.0 EPSS 0.16%

   go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-git’s decoded representa...

9. CVE-2026-41506 go-git Credential leak via cross-host redirect in smart HTTP transport

   Published 2026-05-08

   High·CVSS 7.4 EPSS 0.26%

   go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0...

10. CVE-2026-33762 go-git: Missing validation decoding Index v4 files leads to panic

    Published 2026-03-31

    Low·CVSS 2.8 EPSS 0.18%

    go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can t...

11. CVE-2026-34165 go-git: Maliciously crafted idx file can cause asymmetric memory consumption

    Published 2026-03-31

    Medium·CVSS 5.0 EPSS 0.15%

    go-git is an extensible git implementation library written in pure Go. From version 5.0.0 to before version 5.17.1, a vulnerability has been identified in which a maliciously crafted .idx file can cause asymmetric memory consumption, potentially exhausting available memory and re...

12. CVE-2026-25934 go-git improperly verifies data integrity values for .idx and .pack files

    Published 2026-02-09

    Medium·CVSS 4.3 EPSS 0.16%

    go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files,...

13. CVE-2025-21614 go-git clients vulnerable to DoS via maliciously crafted Git server replies

    Published 2025-01-06

    High·CVSS 7.5 EPSS 0.72%

    go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted respons...

14. CVE-2025-21613 go-git has an Argument Injection via the URL field

    Published 2025-01-06

    Critical·CVSS 9.2 EPSS 1.3%

    go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flag...

15. CVE-2023-49569 Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients

    Published 2024-01-12

    Critical·CVSS 9.8 EPSS 1.5%

    A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved. Applications are only affected if they are...

16. CVE-2023-49568 Maliciously crafted Git server replies can cause DoS on go-git clients

    Published 2024-01-12

    High·CVSS 7.5 EPSS 0.70%

    A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Ap...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.