Executive brief
go-git is a library used by applications to interact with Git repositories. A vulnerability was found where processing specially crafted Git data can cause an application to crash or consume excessive system resources. This could lead to a service outage for any tool that clones or opens untrusted repositories. Users should update to the latest version to maintain service availability.
Technical details
Multiple denial-of-service (DoS) vulnerabilities exist in go-git due to improper handling of malformed Git object data. The root cause is uncontrolled resource consumption (CWE-400) when parsing malicious .pack, .idx, or loose objects. An attacker can exploit this by providing a crafted repository to an application that uses go-git for operations like cloning, fetching, or opening repositories. This can result in a process panic or resource exhaustion. The issue is fixed in versions 5.19.1 and 6.0.0-alpha.4.
Affected products
- go-git go-git/v5 <= 5.19.0
- go-git go-git/v6 <= 6.0.0-alpha.3
Timeline
- 2026-05-18: disclosed: Initial disclosure to maintainers
- 2026-05-29: advisory: GitHub Advisory published