Executive brief
go-git is a software library used by developers to integrate Git functionality into Go-based applications. A vulnerability in how the library handles specific Git index files could allow an attacker with local access to crash the application by exhausting its memory. This results in a denial-of-service, potentially disrupting development workflows or services that rely on the library to process repository data.
Technical details
A vulnerability exists in go-git's handling of Git index (.idx) files due to an integer underflow (CWE-191) and lack of resource limits (CWE-770). By providing a maliciously crafted .idx file, an attacker can trigger excessive memory allocation, leading to a denial-of-service (DoS) via memory exhaustion. Exploitation requires the attacker to have local write access to the .git directory of a repository to place or modify the .idx file, and requires the victim to interact with the repository using the vulnerable library. The issue is rooted in the plumbing/format/idxfile component and has been addressed in version 5.17.1 by improving version and fanout checks.
Affected products
- go-git project go-git >= 5.0.0, < 5.17.1
Timeline
- 2026-03-29: patched: Version 5.17.1 released.
- 2026-03-31: disclosed: Public advisory published.