CVE-2025-21613

Impact

An argument injection vulnerability was discovered in go-git versions prior to v5.13.

Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries.

Affected versions

Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.

Workarounds

In cases where a bump to the latest version of go-git is not possible, we recommend users to enforce restrict validation rules for values passed in the URL field.

Credit

Thanks to @vin01 for responsibly disclosing this vulnerability to us.

go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• go-git: argument injection via the URL field (CVE-2025-21613)
• go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies (CVE-2025-21614)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.

go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.

go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.

go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.

Argument Injection via the URL field in github.com/go-git/go-git

This update for trivy fixes the following issues:

Update to version 0.58.2 (

  boo#1234512, CVE-2024-45337,
  boo#1235265, CVE-2024-45338):

• fix(misconf): allow null values only for tf variables [backport: release/v0.58] (#8238)
• fix(suse): SUSE - update OSType constants and references for compatility [backport: release/v0.58] (#8237)
• fix: CVE-2025-21613 and CVE-2025-21614 : go-git: argument injection via the URL field [backport: release/v0.58] (#8215)
• fix(sbom): attach nested packages to Application [backport: release/v0.58] (#8168)
• fix(python): skip dev group's deps for poetry [backport: release/v0.58] (#8158)
• fix(sbom): use root package for unknown dependencies (if exists) [backport: release/v0.58] (#8156)
• chore(deps): bump golang.org/x/net from v0.32.0 to v0.33.0 [backport: release/v0.58] (#8142)
• chore(deps): bump github.com/CycloneDX/cyclonedx-go from v0.9.1 to v0.9.2 [backport: release/v0.58] (#8136)
• fix(redhat): correct rewriting of recommendations for the same vulnerability [backport: release/v0.58] (#8135)
• fix(oracle): add architectures support for advisories [backport: release/v0.58] (#8125)
• fix(sbom): fix wrong overwriting of applications obtained from different sbom files but having same app type [backport: release/v0.58] (#8124)
• chore(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 [backport: release/v0.58] (#8122)
• fix: handle BLOW_UNKNOWN error to download DBs [backport: release/v0.58] (#8121)
• fix(java): correctly overwrite version from depManagement if dependency uses project.* props [backport: release/v0.58] (#8119)
• release: v0.58.0 [main] (#7874)
• fix(misconf): wrap AWS EnvVar to iac types (#7407)
• chore(deps): Upgrade trivy-checks (#8018)
• refactor(misconf): Remove unused options (#7896)
• docs: add terminology page to explain Trivy concepts (#7996)
• feat: add workspaceRelationship (#7889)
• refactor(sbom): simplify relationship generation (#7985)
• docs: improve databases documentation (#7732)
• refactor: remove support for custom Terraform checks (#7901)
• docs: drop AWS account scanning (#7997)
• fix(aws): change CPU and Memory type of ContainerDefinition to a string (#7995)
• fix(cli): Handle empty ignore files more gracefully (#7962)
• fix(misconf): load full Terraform module (#7925)
• fix(misconf): properly resolve local Terraform cache (#7983)
• refactor(k8s): add v prefix for Go packages (#7839)
• test: replace Go checks with Rego (#7867)
• feat(misconf): log causes of HCL file parsing errors (#7634)
• chore(deps): bump the aws group across 1 directory with 7 updates (#7991)
• chore(deps): bump github.com/moby/buildkit from 0.17.0 to 0.17.2 in the docker group across 1 directory (#7990)
• chore(deps): update csaf module dependency from csaf-poc to gocsaf (#7992)
• chore: downgrade the failed block expand message to debug (#7964)
• fix(misconf): do not erase variable type for child modules (#7941)
• feat(go): construct dependencies of go.mod main module in the parser (#7977)
• feat(go): construct dependencies in the parser (#7973)
• feat: add cvss v4 score and vector in scan response (#7968)
• docs: add overview page for others (#7972)
• fix(sbom): Fixes for Programming Language Vulnerabilities and SBOM Package Maintainer Details (#7871)
• feat(suse): Align SUSE/OpenSUSE OS Identifiers (#7965)
• chore(deps): bump the common group with 4 updates (#7949)
• feat(oracle): add flavors support (#7858)
• fix(misconf): Update trivy-checks default repo to mirror.gcr.io (#7953)
• chore(deps): Bump up trivy-checks to v1.3.0 (#7959)
• fix(k8s): check all results for vulnerabilities (#7946)
• ci(helm): bump Trivy version to 0.57.1 for Trivy Helm Chart 0.9.0 (#7945)
• feat(secret): Add built-in secrets rules for Private Packagist (#7826)
• docs: Fix broken links (#7900)
• docs: fix mistakes/typos (#7942)
• feat: Update registry…

These are all security issues fixed in the govulncheck-vulndb-0.0.20250108T191942-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the grafana-11.3.0-5.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the amazon-ssm-agent-3.3.1611.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the trivy-0.58.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the rime-schema-all-20230603+git.5fdd2d6-5.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the rime-plum-1.0.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the rz-pm-0.3.3+git14gcee0d0d-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cheat-4.4.2-2.1 package on the GA media of openSUSE Tumbleweed.

This update for trivy fixes the following issues:

Changes in trivy:

Update to version 0.67.2 (bsc#1250625, CVE-2025-11065, bsc#1248897, CVE-2025-58058):

• fix: Use fetch-level: 1 to check out trivy-repo in the release workflow [backport: release/v0.67] (#9638)
• fix: restore compatibility for google.protobuf.Value [backport: release/v0.67] (#9631)
• fix: using SrcVersion instead of Version for echo detector [backport: release/v0.67] (#9629)
• fix: add buildInfo for BlobInfo in rpc package [backport: release/v0.67] (#9615)
• fix(vex): don't use reused BOM [backport: release/v0.67] (#9612)
• fix(vex): don't suppress vulns for packages with infinity loop (#9465)
• fix(aws): use BuildableClient insead of xhttp.Client (#9436)
• refactor(misconf): replace github.com/liamg/memoryfs with internal mapfs and testing/fstest (#9282)
• docs: clarify inline ignore limitations for resource-less checks (#9537)
• fix(k8s): disable parallel traversal with fs cache for k8s images (#9534)
• fix(misconf): handle tofu files in module detection (#9486)
• feat(seal): add seal support (#9370)
• docs: fix modules path and update code example (#9539)
• fix: close file descriptors and pipes on error paths (#9536)
• feat: add documentation URL for database lock errors (#9531)
• fix(db): Dowload database when missing but metadata still exists (#9393)
• feat(cloudformation): support default values and list results in Fn::FindInMap (#9515)
• fix(misconf): unmark cty values before access (#9495)
• feat(cli): change --list-all-pkgs default to true (#9510)
• fix(nodejs): parse workspaces as objects for package-lock.json files (#9518)
• refactor(fs): use underlyingPath to determine virtual files more reliably (#9302)
• refactor: remove google/wire dependency and implement manual DI (#9509)
• chore(deps): bump the aws group with 6 updates (#9481)
• chore(deps): bump the common group across 1 directory with 24 updates (#9507)
• fix(misconf): wrap legacy ENV values in quotes to preserve spaces (#9497)
• docs: move info about detection priority into coverage section (#9469)
• feat(sbom): added support for CoreOS (#9448)
• fix(misconf): strip build metadata suffixes from image history (#9498)
• feat(cyclonedx): preserve SBOM structure when scanning SBOM files with vulnerability updates (#9439)
• docs: Fix typo in terraform docs (#9492)
• feat(redhat): add os-release detection for RHEL-based images (#9458)
• ci(deps): add 3-day cooldown period for Dependabot updates (#9475)
• refactor: migrate from go-json-experiment to encoding/json/v2 (#9422)
• fix(vuln): compare nuget package names in lower case (#9456)
• chore: Update release flow to include chocolatey (#9460)
• docs: document eol supportability (#9434)
• docs(report): add nuanses about secret/license scanner in summary table (#9442)
• ci: use environment variables in GitHub Actions for improved security (#9433)
• chore: bump Go to 1.24.7 (#9435)
• fix(nodejs): use snapshot string as Package.ID for pnpm packages (#9330)
• ci(helm): bump Trivy version to 0.66.0 for Trivy Helm Chart 0.18.0 (#9425)

Update to version 0.66.0 (bsc#1248937, CVE-2025-58058):

• chore(deps): bump the aws group with 7 updates (#9419)
• refactor(secret): clarify secret scanner messages (#9409)
• fix(cyclonedx): handle multiple license types (#9378)
• fix(repo): sanitize git repo URL before inserting into report metadata (#9391)
• test: add HTTP basic authentication to git test server (#9407)
• fix(sbom): add support for file component type of CycloneDX (#9372)
• fix(misconf): ensure module source is known (#9404)
• ci: migrate GitHub Actions from version tags to SHA pinning (#9405)
• fix: create temp file under composite fs dir (#9387)
• chore(deps): bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 (#9403)
• refactor: switch to stable azcontainerregistry SDK package (#9319)
• chore(deps): bump the common…

This update for cheat fixes the following issues:

• Security:

  • CVE-2025-47913: Fix client process termination (bsc#1253593)
  • CVE-2025-58181: Fix potential unbounded memory consumption (bsc#1253922)
  • CVE-2025-47914: Fix panic due to an out of bounds read (bsc#1254051)
  • Replace golang.org/x/crypto=golang.org/x/[email protected]
  • Replace golang.org/x/net=golang.org/x/[email protected]
  • Replace golang.org/x/sys=golang.org/x/[email protected]

• Packaging improvements:

  • Drop Requires: golang-packaging. The recommended Go toolchain dependency expression is BuildRequires: golang(API) >= 1.x or optionally the metapackage BuildRequires: go
  • Use BuildRequires: golang(API) >= 1.19 matching go.mod
  • Build PIE with pattern that may become recommended procedure: %%ifnarch ppc64 GOFLAGS="-buildmode=pie" %%endif go build A go toolchain buildmode default config would be preferable but none exist at this time.
  • Drop mod=vendor, go1.14+ will detect vendor dir and auto-enable
  • Remove go build -o output binary location and name. Default binary has the same name as package of func main() and is placed in the top level of the build directory.
  • Add basic %check to execute binary --help

• Packaging improvements:

  • Service go_modules replace dependencies with CVEs
  • Replace github.com/cloudflare/circl=github.com/cloudflare/[email protected] Fix GO-2025-3754 GHSA-2x5j-vhc8-9cwm
  • Replace golang.org/x/net=golang.org/x/[email protected] Fixes GO-2025-3503 CVE-2025-22870
  • Replace golang.org/x/crypto=golang.org/x/[email protected] Fixes GO-2023-2402 CVE-2023-48795 GHSA-45x7-px36-x8w8 Fixes GO-2025-3487 CVE-2025-22869
  • Replace github.com/go-git/go-git/v5=github.com/go-git/go-git/[email protected] Fixes GO-2025-3367 CVE-2025-21614 GHSA-r9px-m959-cxf4 Fixes GO-2025-3368 CVE-2025-21613 GHSA-v725-9546-7q7m
  • Service tar_scm set mode manual from disabled
  • Service tar_scm create archive from git so we can exclude vendor directory upstream committed to git. Committed vendor directory contents have build issues even after go mod tidy.
  • Service tar_scm exclude dir vendor
  • Service set_version set mode manual from disabled
  • Service set_version remove param basename not needed

This update for grafana fixes the following issues:

Changes in grafana:

• Update to version 11.6.11: Features and enhancements:

  • Alerting: Add limits for the size of expanded notification templates
  • Correlations: Remove support for org_id=0 Security:
  • CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136)

• Update to version 11.6.10: Features and enhancements:

  • API: Add missing scope check on dashboards
  • Avatar: Require sign-in, remove queue, respect timeout Bug fixes:
  • Alerting: Fix a race condition panic in ResetStateByRuleUID

• Update to version 11.6.9: Features and enhancements:

  • Plugins: Add PluginContext to plugins when scenes is disabled Bug fixes:
  • Alerting: Fix contacts point issues

• Update to version 11.6.8: Bug fixes:

  • Alerting: Fix unmarshalling of GettableStatus to include time intervals

• Update to version 11.6.7: Bug fixes:

  • Auth: Fix render user OAuth passthrough
  • LDAP Authentication: Fix URL to propagate username context as parameter
  • Plugins: Dependencies do not inherit parent URL for preinstall
  • URLParams: Stringify true values as key=true always (fixes issues with variables with true value)

• Update to version 11.6.6: Bug fixes:

  • Alerting: Fix copying of recording rule fields
  • Fix redirection after login when Grafana is served from subpath

• Update to version 11.6.5: Features and enhancements:

  • Alerting: Bump alerting package to include change to NewTLSClient

• Update to version 11.6.4: Features and enhancements:

  • StateTimeline: Add endTime to tooltip
  • Unified storage: Respect GF_DATABASE_URL override Bug fixes:
  • Alerting: Fix group interval override when adding new rules
  • Azure: Fix legend formatting
  • Azure: Fix resource name determination in template variable queries
  • Graphite: Fix annotation queries
  • Graphite: Fix date mutation
  • Graphite: Fix nested variable interpolation for repeated rows

• Update to version 11.6.3: Security:

  • Fixes CVE-2025-3415

• Update to version 11.6.2: Bug fixes:

  • Dashboard: Fixes issue with row repeats and first row
  • Graphite: Ensure template variables are interpolated correctly
  • Graphite: Fix Graphite series interpolation
  • Prometheus: Fix semver import path

• Update to version 11.6.1: Features and enhancements:

  • DashboardScenePage: Correct slug in self referencing data links
  • GrafanaUI: Use safePolygon close handler for interactive tooltips instead of a delay
  • Prometheus: Add support for cloud partners Prometheus data sources Bug fixes:
  • Alertmanager: Add Role-Based Access Control via reqAction Field
  • GrafanaUI: Remove blurred background from overlay backdrops to improve performance
  • InfluxDB: Fix nested variable interpolation
  • LDAP test: Fix page crash
  • Org redirection: Fix linking between orgs

• Upgrade to version 11.6.0: Features and enhancements:

  • Visualisations: One click links and actions
  • Annotations: Add cron syntax support
  • WebGL-powered geomaps for better performance
  • Alerting: Add alert rule version history Security:
  • API keys: Migrate API keys to service accounts at startup

• CVE-2026-21721: Fix access control by the dashboard permissions API (bsc#1257337)

• CVE-2026-21720: Fix unauthenticated DoS (bsc#1257349)

• CVE-2025-68156: Fix potential DoS via unbounded recursion in builtin functions (bsc#1255340)

• CVE-2025-64751: Drop experimental implementation of authorization Zanzana server/client (bsc#1254113)

• Use forked wire from Grafana repository instead of external package (jsc#PED-14178).

• Update to version 11.5.10: Security:

  • CVE-2025-47911: Fix parsing HTML documents (bsc#1251454)
  • CVE-2025-58190: Fix excessive memory consumption (bsc#1251657) Features and enhancements:
  • Update to Go 1.25
  • Update to golang.org/x/net v0.45.0 Bug fixes:
  • Auth: Fix render user OAuth…

This update for trivy fixes the following issues:

Update to version 0.68.2:

Security fixes:

• CVE-2024-3817: hashicorp/go-getter: argument injection when fetching remote default git branches (bsc#1227010).
• CVE-2024-45337: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto (bsc#1234512).
• CVE-2024-45338: golang.org/x/net/html: denial of service due to non-linear parsing of case-insensitive content (bsc#1235265).
• CVE-2024-51744: github.com/golang-jwt/jwt/v4: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt (bsc#1232948).
• CVE-2025-11065: github.com/go-viper/mapstructure/v2: sensitive Information leak in logs (bsc#1250625).
• CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239225).
• CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239385).
• CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241724).
• CVE-2025-27144: gopkg.in/go-jose/go-jose.v2: Go JOSE's Parsing Vulnerable to Denial of Service (bsc#1237618).
• CVE-2025-30204: github.com/golang-jwt/jwt/v4,github.com/golang-jwt/jwt/v5: jwt-go allows excessive memory allocation during header parsing (bsc#1240466).
• CVE-2025-46569: github.com/open-policy-agent/opa: HTTP request path can be crafted to inject Rego code into a constructed query when a virtual document is requested through the Data API (bsc#1246730).
• CVE-2025-47291: github.com/containerd/containerd/v2: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods. (bsc#1243633).
• CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251363).
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253512).
• CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1253977).
• CVE-2025-53547: helm.sh/helm/v3: Helm Chart Code Execution (bsc#1246151).
• CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory (bsc#1248937, bsc#1248897).
• CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253786).
• CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input (bsc#1251547).

Other fixes:

• Update installation.md (#8979)
• chore(alpine): add EOL date for Alpine 3.21 (#8221)
• chore(alpine): add EOL date for Alpine 3.22 (#8992)
• chore(cli): Remove Trivy Cloud (#9847)
• chore(deps): Bump trivy-checks (#7819)
• chore(deps): Bump trivy-checks (#8310)
• chore(deps): Bump trivy-checks (#8619)
• chore(deps): Bump trivy-checks (#8934)
• chore(deps): Bump trivy-checks to v1.7.1 (#8467)
• chore(deps): Bump up trivy-checks to v1.3.0 (#7959)
• chore(deps): Switch to go-viper/mapstructure (#9579)
• chore(deps): Update trivy-checks (#8798)
• chore(deps): Upgrade trivy-checks (#8018)
• chore(deps): bump Go to v1.23.5 (#8341)
• chore(deps): bump Go to v1.23.5 [backport: release/v0.59] (#8343)
• chore(deps): bump github.com/CycloneDX/cyclonedx-go from v0.9.1 to v0.9.2 (#8105)
• chore(deps): bump github.com/CycloneDX/cyclonedx-go from v0.9.1 to v0.9.2 [backport: release/v0.58] (#8136)
• chore(deps): bump golang.org/x/net from v0.32.0 to v0.33.0 (#8140)
• chore(deps): bump golang.org/x/net from v0.32.0 to v0.33.0 [backport: release/v0.58] (#8142)
• chore(deps): bump alpine from 3.20.0 to 3.21.0 in the docker group across 1 directory (#8196)
• chore(deps): bump alpine from…

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

• GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj
• GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c
• GO-2026-5102 CVE-2026-45021 GHSA-3vcp-chfh-f6r2
• GO-2026-5272 CVE-2026-40938 GHSA-94jr-7pqp-xhcq
• GO-2026-5486 CVE-2026-40924 GHSA-m2cx-gpqf-qf74
• GO-2026-5542 CVE-2026-40090 GHSA-pj97-4p9w-gx3q
• GO-2026-5630 CVE-2026-25542 GHSA-rmx9-2pp3-xhcr
• GO-2026-5643 CVE-2026-40923 GHSA-rx35-6rhx-7858
• GO-2026-5675 CVE-2026-41492 GHSA-vvf7-6rmr-m29q
• GO-2026-5711 CVE-2026-40161 GHSA-wjxp-xrpv-xpff
• GO-2026-5746 CVE-2026-41567 GHSA-x86f-5xw2-fm2r
• GO-2026-5749 CVE-2026-41328 GHSA-x92x-px7w-4gx4
• GO-2026-5837 CVE-2026-44840 GHSA-q2m9-6jp9-c6mc
• GO-2026-5929 CVE-2026-44342 GHSA-26v7-h57m-gh9m
• GO-2026-5930 CVE-2026-33655 GHSA-6qcr-qxgr-m7fv
• GO-2026-5933 GHSA-3g4q-2f67-2gvh
• GO-2026-5934 GHSA-59qp-cfj3-rp64
• GO-2026-5935 GHSA-7856-g3gv-9wq8
• GO-2026-5936 CVE-2026-53552 GHSA-26rh-24rg-j3vv
• GO-2026-5937 CVE-2026-53508 GHSA-2jcc-mxv7-p3f9
• GO-2026-5938 CVE-2026-53553 GHSA-4g5x-hcwm-82jw
• GO-2026-5939 CVE-2026-10517 GHSA-698x-9w2p-7vvp
• GO-2026-5940 CVE-2026-53572 GHSA-6w3m-4hhp-775q
• GO-2026-5941 CVE-2026-53487 GHSA-gvhc-wv3v-7pf8
• GO-2026-5942 CVE-2026-46600
• GO-2026-5944 CVE-2026-50197 GHSA-659f-rgp5-w4wf
• GO-2026-5945 CVE-2026-6815 GHSA-rmxx-v9rj-vpvg
• GO-2026-5946 CVE-2026-52831 GHSA-v5px-423j-pf7p
• GO-2026-5947 CVE-2026-53649 GHSA-xqhv-chqm-fhcc
• GO-2026-5948 CVE-2026-50554 GHSA-588f-fvcv-xhvf
• GO-2026-5949 CVE-2026-50553 GHSA-rqrh-8wpv-x7hh
• GO-2026-5950 CVE-2026-53602 GHSA-339v-266x-79xr
• GO-2026-5951 CVE-2026-10219 GHSA-6jm8-4fhr-5w64
• GO-2026-5952 CVE-2026-49834 GHSA-9vcr-p3rj-q5q6
• GO-2026-5953 CVE-2026-9094 GHSA-c9w5-qp6m-m395
• GO-2026-5956 CVE-2026-55252 GHSA-h5g6-xmh4-hc37
• GO-2026-5957 CVE-2026-54158 GHSA-5xfx-xj4h-5p7r
• GO-2026-5958 CVE-2026-54068 GHSA-gcm7-57gf-953c
• GO-2026-5959 CVE-2026-54072 GHSA-h29v-hj44-q8cv
• GO-2026-5961 CVE-2026-54069 GHSA-hvr9-72v2-fff3
• GO-2026-5962 CVE-2026-54088 GHSA-m93h-4hw7-5qcm
• GO-2026-5963 CVE-2026-54067 GHSA-mvjr-vv3c-w4qv
• GO-2026-5964 CVE-2026-54066 GHSA-p4m3-mgmm-c664
• GO-2026-5965 CVE-2026-54070 GHSA-w7cg-whh7-xp28
• GO-2026-5966 CVE-2026-54089 GHSA-xqp3-jq6g-x3qm
• GO-2026-5967 CVE-2026-50551 GHSA-56mp-4f3v-fgj2
• GO-2026-5968 CVE-2026-54174 GHSA-fpg8-7664-jc5q
• GO-2026-5969 GHSA-g936-7jqj-mwv8
• GO-2026-5970 CVE-2026-56852
• GO-2026-5973 CVE-2026-54250 GHSA-jxr7-mqhw-9p98
• GO-2026-5974 CVE-2026-44300 GHSA-wmj8-9953-vff5
• GO-2026-5975 CVE-2026-50018 GHSA-42j2-w334-qxw7
• GO-2026-5976 CVE-2026-50141 GHSA-g7mm-9vx7-jm7h
• GO-2026-5977 CVE-2026-50013 GHSA-qrh4-p6v4-mrfg
• GO-2026-5978 CVE-2026-50125 GHSA-qw5r-ppcg-f8rj
• GO-2026-5979 CVE-2026-50006 GHSA-xrcf-6jh3-ggvx
• GO-2026-5980 CVE-2026-50158 GHSA-2c7f-fxww-6w6c
• GO-2026-5981 GHSA-mqxv-9rm6-w8qc
• GO-2026-5982 GHSA-pqg7-v6wh-3pfp
• GO-2026-5984 CVE-2026-53604 GHSA-2p2f-px33-4vv5
• GO-2026-5985 GHSA-7rx3-5wx3-5v76
• GO-2026-5986 CVE-2026-61699 GHSA-cm26-5974-52h8
• GO-2026-5987 CVE-2026-55513 GHSA-g4x6-jcvr-9m3g
• GO-2026-5988 CVE-2026-54628 GHSA-hwrq-8wxh-q4xv
• GO-2026-5989 CVE-2026-55512 GHSA-m3cx-mwpg-32jg
• GO-2026-5990 CVE-2026-54629 GHSA-mf78-3rpf-r784
• GO-2026-5991 CVE-2026-53603 GHSA-q4vm-pq3q-8wgq
• GO-2026-5992 CVE-2026-61549 GHSA-qf34-295c-26v8
• GO-2026-5996 CVE-2026-54450 GHSA-pph6-vfjv-vpjw
• GO-2026-5997 CVE-2026-54452 GHSA-xgch-x3mx-cm3c
• GO-2026-5998 CVE-2026-54495 GHSA-398h-7f66-3h4p
• GO-2026-5999 CVE-2026-10814 GHSA-jh6h-v6mp-h22v
• GO-2026-6002 CVE-2026-58196 GHSA-pr64-jmmf-jp54
• GO-2026-6003 CVE-2026-53714 GHSA-22xc-xg2r-9j7v
• GO-2026-6004 CVE-2026-52833 GHSA-3v79-m2cg-89ww
• GO-2026-6005 CVE-2026-53715 GHSA-8fv2-88gg-hm7q
• GO-2026-6006 CVE-2026-53716 GHSA-cxpq-8v7q-cg56 *…

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• go-git: argument injection via the URL field (CVE-2025-21613)

• go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies (CVE-2025-21614)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20250108T191942 2025-01-08T19:19:42Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2025-3371 GHSA-2r2v-9pf8-6342
  • GO-2025-3374 CVE-2025-22130 GHSA-j4jw-m6xr-fv6c

• Update to version 0.0.20250107T160406 2025-01-07T16:04:06Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2025-3363 GO-2025-3364 GO-2025-3367 GO-2025-3368
  • GO-2024-3355 CVE-2024-54148 GHSA-r7j8-5h9c-f6fx
  • GO-2024-3356 CVE-2024-55947 GHSA-qf5v-rp47-55gg
  • GO-2024-3357 CVE-2024-56362 GHSA-xwx7-p63r-2rj8
  • GO-2024-3358 CVE-2024-45387 GHSA-vq94-9pfv-ccqr
  • GO-2024-3359 CVE-2024-28892 GHSA-5qww-56gc-f66c
  • GO-2024-3360 CVE-2024-25133 GHSA-wgqq-9qh8-wvqv
  • GO-2025-3361 CVE-2024-55196 GHSA-rv83-h68q-c4wq
  • GO-2025-3362 CVE-2025-21609 GHSA-8fx8-pffw-w498
  • GO-2025-3363 CVE-2024-56514 GHSA-cwrh-575j-8vr3
  • GO-2025-3364 CVE-2024-56513 GHSA-mg7w-c9x2-xh7r
  • GO-2025-3367 CVE-2025-21614 GHSA-r9px-m959-cxf4
  • GO-2025-3368 CVE-2025-21613 GHSA-v725-9546-7q7m

• Update to version 0.0.20241220T214820 2024-12-20T21:48:20Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3101 GHSA-75qh-gg76-p2w4
  • GO-2024-3339 GHSA-8wcc-m6j2-qxvm

• Update to version 0.0.20241220T203729 2024-12-20T20:37:29Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3101 GHSA-75qh-gg76-p2w4
  • GO-2024-3109 CVE-2024-43803 GHSA-pqfh-xh7w-7h3p
  • GO-2024-3333 CVE-2024-45338 GHSA-w32m-9786-jp63
  • GO-2024-3342 GHSA-hxr6-2p24-hf98
  • GO-2024-3343 CVE-2024-9779 GHSA-jhh6-6fhp-q2xp
  • GO-2024-3344 GHSA-32gq-x56h-299c
  • GO-2024-3349 CVE-2024-25131 GHSA-77c2-c35q-254w
  • GO-2024-3350 GHSA-5pf6-cq2v-23ww
  • GO-2024-3354 CVE-2024-12678 GHSA-hr68-hvgv-xxqf

This update for amazon-ssm-agent fixes the following issues:

Update to version 3.3.1611.0:

• CVE-2025-21613: Fixed argument injection via the URL field in github.com/go-git/go-git/v5 (bsc#1235575)

Full changelog: https://github.com/aws/amazon-ssm-agent/compare/3.1.1260.0...3.3.1611.0

This update for amazon-ssm-agent fixes the following issues:

Update to version 3.3.1611.0:

• CVE-2025-21613: Fixed argument injection via the URL field in github.com/go-git/go-git/v5 (bsc#1235575)

Full changelog: https://github.com/aws/amazon-ssm-agent/compare/3.1.1260.0...3.3.1611.0

This update for brise fixes the following issues:

• CVE-2025-21613: Fixed argument injection via the URL field (bsc#1235573).
• CVE-2024-45337: Fixed authorization bypass in golang.org/x/crypto via the ServerConfig.PublicKeyCallback callback (bsc#1234597).

This update for grafana fixes the following issues:

grafana was updated from version 10.4.13 to 10.4.15:

• Security issues fixed:
  • CVE-2024-45339: Fixed vulnerability when creating log files (bsc#1236559)
  • CVE-2024-11741: Fixed the Grafana Alerting VictorOps integration (bsc#1236734)
  • CVE-2025-21613: Removed vulnerable library github.com/go-git/go-git/v5 (bsc#1235574)
  • CVE-2024-28180: Fixed improper handling of highly compressed data (bsc#1235206)
• Other bugs fixed and changes:
  • Alerting: Do not fetch Orgs if the user is authenticated by apikey/sa or render key
  • Added provisioning directories
  • Use /bin/bash in wrapper scripts

This update for grafana fixes the following issues:

grafana was updated from version 10.4.13 to 10.4.15:

• Security issues fixed:
  • CVE-2024-45339: Fixed vulnerability when creating log files (bsc#1236559)
  • CVE-2024-11741: Fixed the Grafana Alerting VictorOps integration (bsc#1236734)
  • CVE-2025-21613: Removed vulnerable library github.com/go-git/go-git/v5 (bsc#1235574)
  • CVE-2024-28180: Fixed improper handling of highly compressed data (bsc#1235206)
• Other bugs fixed and changes:
  • Alerting: Do not fetch Orgs if the user is authenticated by apikey/sa or render key
  • Added provisioning directories
  • Use /bin/bash in wrapper scripts

This update for grafana fixes the following issues:

grafana was updated from version 10.4.13 to 10.4.15:

• Security issues fixed:
  • CVE-2024-45339: Fixed vulnerability when creating log files (bsc#1236559)
  • CVE-2024-11741: Fixed the Grafana Alerting VictorOps integration (bsc#1236734)
  • CVE-2025-21613: Removed vulnerable library github.com/go-git/go-git/v5 (bsc#1235574)
  • CVE-2024-28180: Fixed improper handling of highly compressed data (bsc#1235206)
• Other bugs fixed and changes:
  • Alerting: Do not fetch Orgs if the user is authenticated by apikey/sa or render key
  • Added provisioning directories
  • Use /bin/bash in wrapper scripts

Ionut Lalu discovered that go-git incorrectly handled certain specially crafted Git server responses. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-49568, CVE-2025-21614)

Ionut Lalu discovered that go-git incorrectly handled file system paths when using the ChrootOS implementation. A remote attacker could possibly use this issue to perform a path traversal and create or modify arbitrary files, leading to remote code execution. (CVE-2023-49569)

It was discovered that go-git did not properly sanitize arguments when invoking git-upload-pack using the file transport protocol. An attacker could possibly use this issue to inject arbitrary flag values when interacting with local Git repositories. (CVE-2025-21613)

It was discovered that go-git did not properly verify integrity checks for pack and index files. An attacker could possibly use this issue to cause go-git to process corrupted repository data, resulting in unexpected errors or an incorrect repository state. (CVE-2026-25934)