Executive brief
Clients vulnerable to DoS via maliciously crafted Git server replies in github.com/go-git/go-git
Affected products
- Go github.com/go-git/go-git/v4
- Go github.com/go-git/go-git
- Go gopkg.in/src-d/go-git.v4
- Go github.com/go-git/go-git/v5
Junglewise Threat Intelligence
CVE-2025-21614: GO-2025-3367 - Clients vulnerable to DoS via maliciously crafted Git server replies in github.com/go-git/go-git
CVE-2025-21614 · Severity: low · CVSS 3.1 · Published 2025-01-07
Technologies: github.com/go-git/go-git/v4 (Go), github.com/go-git/go-git (Go), gopkg.in/src-d/go-git.v4 (Go), github.com/go-git/go-git/v5 (Go). Vendors: Go.
Related threats
- go-git path traversal via malicious reference names
- go-git symlink traversal in worktree operations
- GO-2026-5693 - Go-git: Malformed Git object data may cause panics or resource exhaustion in github.com/go-git/go-git
- go-git DoS via malformed Git object data
- go-git: Malformed Git object data may cause panics or resource exhaustion