Every CVE Search/ Get API key

CVE-2026-71557

go-git: Malicious reference names may modify files outside the reference storage

6.3 MediumPublic exploitFix available

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
Low

Exploit likelihood

0.41%Up 0.1 points since Aug 8, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.3

go-git: Malicious reference names may modify files outside the reference storage

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.

Record
CVE-2026-71557
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2026-54527 6.3

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.

Record
EUVD-2026-54527
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-qgq7-7hm3-q39j 6.3

go-git: Malicious reference names may modify files outside the reference storage

Impact

A path traversal issue in go-git could allow malicious reference names to access files outside the repository's intended reference storage.

Loose references are stored under .git/<reference-name>. The reference name was previously used as a path without verifying that the resolved path remained within the reference storage. A name such as refs/heads/../../config could therefore resolve to unrelated repository metadata such as .git/config or .git/HEAD.

A malicious Git server could advertise such a reference name. The name may also survive refspec mapping; for example, it could be mapped to refs/remotes/origin/../../config during a clone or fetch operation.

This vulnerability affects filesystem-backed repositories using the storage/filesystem package and its dotgit reference storage. Users relying exclusively on the in-memory storage implementation, storage/memory, are not affected, because reference names are not resolved as filesystem paths.

Exploitation requires an application using go-git with filesystem-backed storage to interact with a malicious Git server or otherwise process attacker-controlled reference names.

Patches

The issue has been addressed by validating reference names at the dotgit storage entry points and rejecting names whose resolved paths could escape the reference storage.

Users of filesystem-backed storage should upgrade to a patched version.

Workarounds

Applications that exclusively use storage/memory are not affected and do not require a workaround for this vulnerability.

For applications using filesystem-backed storage, avoid cloning from or fetching from untrusted Git servers until an upgrade is possible.

Applications that directly construct or process reference names may also validate them before passing them to filesystem-backed go-git storage. Application-level validation should only be considered a temporary mitigation and does not replace upgrading to a patched version.

References

Credits

Thanks to @Saku0512 for reporting this issue and @Sahana2524 for proposing the initial fix. 🙇

Record
GHSA-qgq7-7hm3-q39j
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
Weakness
CWE-22
Updated
2026-11-02
NVD 6.3

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.

Record
CVE-2026-71557
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
Weakness
CWE-22
Updated
2026-11-02
OSV 6.3

go-git: Malicious reference names may modify files outside the reference storage

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.

Record
CVE-2026-71557
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
Weakness
CWE-22
Updated
2026-11-02
OSVDEBIAN-CVE-2026-71557 6.3

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.

Record
DEBIAN-CVE-2026-71557
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
Updated
2026-11-02
Show 20 moreShow less
OSVGHSA-qgq7-7hm3-q39j 6.3

go-git: Malicious reference names may modify files outside the reference storage

Impact

A path traversal issue in go-git could allow malicious reference names to access files outside the repository's intended reference storage.

Loose references are stored under .git/<reference-name>. The reference name was previously used as a path without verifying that the resolved path remained within the reference storage. A name such as refs/heads/../../config could therefore resolve to unrelated repository metadata such as .git/config or .git/HEAD.

A malicious Git server could advertise such a reference name. The name may also survive refspec mapping; for example, it could be mapped to refs/remotes/origin/../../config during a clone or fetch operation.

This vulnerability affects filesystem-backed repositories using the storage/filesystem package and its dotgit reference storage. Users relying exclusively on the in-memory storage implementation, storage/memory, are not affected, because reference names are not resolved as filesystem paths.

Exploitation requires an application using go-git with filesystem-backed storage to interact with a malicious Git server or otherwise process attacker-controlled reference names.

Patches

The issue has been addressed by validating reference names at the dotgit storage entry points and rejecting names whose resolved paths could escape the reference storage.

Users of filesystem-backed storage should upgrade to a patched version.

Workarounds

Applications that exclusively use storage/memory are not affected and do not require a workaround for this vulnerability.

For applications using filesystem-backed storage, avoid cloning from or fetching from untrusted Git servers until an upgrade is possible.

Applications that directly construct or process reference names may also validate them before passing them to filesystem-backed go-git storage. Application-level validation should only be considered a temporary mitigation and does not replace upgrading to a patched version.

References

Credits

Thanks to @Saku0512 for reporting this issue and @Sahana2524 for proposing the initial fix. 🙇

Record
GHSA-qgq7-7hm3-q39j
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
Weakness
CWE-22
Updated
2026-11-02
OSVRHSA-2026:66208 7.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:66208
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Updated
2026-11-02
OSVRHSA-2026:68281 6.7

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:68281
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:68806 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:68806
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:68808 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:68808
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-71557 6.3

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.

Record
UBUNTU-CVE-2026-71557
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
Updated
2026-11-02
OSVAZL-94673 No score

CVE-2026-71557 affecting package cri-o 1.30.1-1

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.

Record
AZL-94673
Updated
2026-11-05
OSVAZL-95487 No score

CVE-2026-71557 affecting package packer for versions less than 1.9.5-20

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.

Record
AZL-95487
Updated
2026-11-05
OSVGO-2026-6214 No score

Path traversal via crafted reference names in github.com/go-git/go-git

Path traversal via crafted reference names in github.com/go-git/go-git

Record
GO-2026-6214
Updated
2026-11-02
OSVopenSUSE-SU-2026:11803-1 No score

alloy-1.19.2-1.1 on GA media

These are all security issues fixed in the alloy-1.19.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11803-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21761-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-5026 CVE-2026-39821
    • GO-2026-6225
    • GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw
    • GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h
    • GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q
    • GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6
    • GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86
    • GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p
    • GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6
    • GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68
    • GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v
    • GO-2026-6262 GHSA-22w5-2fxg-vrwx
    • GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28
    • GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j
    • GO-2026-6265 GHSA-8fxq-53rx-ph5f
    • GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m
    • GO-2026-6267 GHSA-h58c-xccx-75m3
    • GO-2026-6268 GHSA-q9c5-pp7m-fm2g
    • GO-2026-6269 GHSA-rxhg-vcww-2mpw
    • GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5
    • GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m
    • GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97
    • GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28
    • GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w
    • GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34
    • GO-2026-6277 GHSA-4ph6-mjv7-3fq6
    • GO-2026-6278 GHSA-w67g-5rqw-f597
    • GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v
    • GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw
    • GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4
    • GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9
    • GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q
    • GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg
    • GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr
    • GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4
    • GO-2026-6287 GHSA-vx2m-jpxr-xv7w
    • GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr
    • GO-2026-6289 GHSA-w8j7-39hp-8x59
    • GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3
    • GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58
    • GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m
    • GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq
    • GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff
    • GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx
    • GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9
    • GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm
    • GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp
    • GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px
    • GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf
    • GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf

  • Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-4720 GHSA-v3mg-9v85-fcm7
    • GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc
    • GO-2026-4950
    • GO-2026-6093 GHSA-464c-974j-9xm6
    • GO-2026-6094 GHSA-gcjh-h69q-9w9g
    • GO-2026-6095 GHSA-r277-6w6q-xmqw
    • GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737
    • GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv
    • GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q
    • GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv
    • GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf
    • GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8
    • GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp
    • GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp
    • GO-2026-6105 GHSA-c534-2w9c-x7fm
    • GO-2026-6106 GHSA-v6w6-358x-2433
    • GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3
    • GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq
    • GO-2026-6109 GHSA-86cx-wwf4-phq4
    • GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75
    • GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h
    • GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq
    • GO-2026-6113 GHSA-p6ph-3jx2-3337
    • GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8
    • GO-2026-6115 CVE-2026-56867
    • GO-2026-6117 GHSA-hp74-gm6m-2qm5
    • GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7
    • GO-2026-6119 CVE-2026-43983…
Record
openSUSE-SU-2026:21761-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21884-1 No score

Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issues:

  • CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278681).
  • CVE-2026-71556: github.com/go-git/go-git/v5: arbitrary file read/write via symbolic link resolution (bsc#1276981).
  • CVE-2026-71557: github.com/go-git/go-git/v5: malicious reference names may modify files outside the reference storage (bsc#1276994).

Changes for amazon-ssm-agent:

  • Update to version 3.3.5390.0
  • Bump github.com/gorilla/websocket from v1.4.2 to v1.5.3
  • Bump golang.org/x/crypto from v0.53.0 to v0.56.0
  • Bump golang.org/x/net from v0.56.0 to v0.57.0
  • Bump golang.org/x/sys from v0.46.0 to v0.47.0
  • Upgrade GoLang version from 1.25 to 1.26
  • Mint control-channel token after dial to fix AZ-fault token expiry
  • Resume patch documents interrupted by an external shutdown
  • Use systemctl for systemd in aws: configureDocker on Amazon Linux
  • Update greengrass component version to 1.3.5
  • Update to version 3.3.5226.0
  • Add bounds check for HeaderLength in AgentMessage Deserialize
  • Bump github.com/go-git/go-git/v5 to v5.19.2
  • Bump golang.org/x/sync to v0.21.0
  • Detect Azure Linux and potential future unregistered Linux platforms
  • Fix Windows session command parsing by removing shlex
  • Fix shell injection in Windows domainjoin plugin parameters
  • Prevent control channel deadlock on ProcessorBufferFull
  • Revert migration from aws-sdk-go v1 to aws-sdk-go-v2 change
  • Update the logic for loading RegistrationInfo
  • Upgrade Go version to 1.25.13
  • Update to version 3.3.5068.0
  • Migrate from aws-sdk-go v1 to aws-sdk-go-v2
  • Fix flaky registration/connection channel tests
  • Sync AWS SDK fork in extra/ with multicloud vendor changes
  • Harden function create file with permissions in a single syscall
  • Upgrade Go version to 1.25.12
  • Bump golang.org/x/[email protected] to golang.org/x/[email protected]
  • Fix loopback bypass in remote-host port forwarding denylist
  • Update to version 3.3.4851.0
  • Add ECS/EKS credential endpoints and loopback to port-forward denylist
  • Canonicalize IP addresses before port-forwarding denylist check
  • Pass the ActiveDirectory domain password via stdin using -y /dev/stdin instead of the -w flag
  • Fix false StuckAtInProgress timeout for associations with rate >= 2h
  • Fix non-interactive session big file transfer issues
  • Prevent ssm-user race condition with flock-based serialization
  • Send AWS::EC2::Instance as source type when registered with provider EC2
  • Validate process name in orphan worker detection
  • Update to version 3.3.4793.0
  • Add multicloud support enabling SSM Agent registration with Azure cloud providers
  • Add support for the upcoming public key in the agent code
Record
openSUSE-SU-2026:21884-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22032-1 No score

Security update for alloy

This update for alloy fixes the following issues:

  • CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling (bsc#1269861).
  • CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276742).
  • CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to exfiltration of sensitive data (bsc#1267482).
  • CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS (bsc#1267483).
  • CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI out-of-bounds reads to leak memory into telemetry (bsc#1267484).
  • CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause that memory to be copied into telemetry (bsc#1267486).
  • CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled writev buffers and allows multi-segment calls to read and overwrite memory beyond the first segment (bsc#1267487).
  • CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer (bsc#1272418).
  • CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent (bsc#1268982).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).
  • CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278671).
  • CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).
  • CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage (bsc#1276992).
  • CVE-2026-75889: arbitrary file reads due to the prometheus.operator.servicemonitors component allowing users who can modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile (bsc#1277429).
  • CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in Client.BulkWrite (bsc#1278693).
  • CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames containing a crafted header value type byte outside the valid range can cause the host process to terminate (bsc#1280671).

Changes for alloy:

Update to version 1.19.2:

  • Remove withdrawn lib/pq CVEs from govulncheck
  • Add backticks to component name in generated doc output
  • BREAKING CHANGE: prometheus.operator.servicemonitors now rejects endpoints that reference local files by default. Set allow_arbitrary_file_access = true to preserve previous behavior.
  • prometheus.enrich: Support multi-label matching
  • prometheus.relabel: Add opt-in TTL cache mode
  • telemetry: Add new metrics for graph connections and pyroscope forwarded entries
  • database_observability: Exclude system schemas from MySQL health checks and redact query text in explain_plans
  • Add nop receiver to OTel Engine
  • Backport dependency upgrades to address GO-2026-6061
Record
openSUSE-SU-2026:22032-1
Updated
2026-11-02
OSVSUSE-SU-2026:23625-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-5026 CVE-2026-39821
    • GO-2026-6225
    • GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw
    • GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h
    • GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q
    • GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6
    • GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86
    • GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p
    • GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6
    • GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68
    • GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v
    • GO-2026-6262 GHSA-22w5-2fxg-vrwx
    • GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28
    • GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j
    • GO-2026-6265 GHSA-8fxq-53rx-ph5f
    • GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m
    • GO-2026-6267 GHSA-h58c-xccx-75m3
    • GO-2026-6268 GHSA-q9c5-pp7m-fm2g
    • GO-2026-6269 GHSA-rxhg-vcww-2mpw
    • GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5
    • GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m
    • GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97
    • GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28
    • GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w
    • GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34
    • GO-2026-6277 GHSA-4ph6-mjv7-3fq6
    • GO-2026-6278 GHSA-w67g-5rqw-f597
    • GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v
    • GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw
    • GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4
    • GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9
    • GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q
    • GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg
    • GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr
    • GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4
    • GO-2026-6287 GHSA-vx2m-jpxr-xv7w
    • GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr
    • GO-2026-6289 GHSA-w8j7-39hp-8x59
    • GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3
    • GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58
    • GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m
    • GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq
    • GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff
    • GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx
    • GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9
    • GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm
    • GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp
    • GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px
    • GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf
    • GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf

  • Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-4720 GHSA-v3mg-9v85-fcm7
    • GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc
    • GO-2026-4950
    • GO-2026-6093 GHSA-464c-974j-9xm6
    • GO-2026-6094 GHSA-gcjh-h69q-9w9g
    • GO-2026-6095 GHSA-r277-6w6q-xmqw
    • GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737
    • GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv
    • GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q
    • GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv
    • GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf
    • GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8
    • GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp
    • GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp
    • GO-2026-6105 GHSA-c534-2w9c-x7fm
    • GO-2026-6106 GHSA-v6w6-358x-2433
    • GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3
    • GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq
    • GO-2026-6109 GHSA-86cx-wwf4-phq4
    • GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75
    • GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h
    • GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq
    • GO-2026-6113 GHSA-p6ph-3jx2-3337
    • GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8
    • GO-2026-6115 CVE-2026-56867
    • GO-2026-6117 GHSA-hp74-gm6m-2qm5
    • GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7
    • GO-2026-6119 CVE-2026-43983…
Record
SUSE-SU-2026:23625-1
Updated
2026-11-02
OSVSUSE-SU-2026:24148-1 No score

Security update for alloy

This update for alloy fixes the following issues:

  • CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling (bsc#1269861).
  • CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276742).
  • CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to exfiltration of sensitive data (bsc#1267482).
  • CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS (bsc#1267483).
  • CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI out-of-bounds reads to leak memory into telemetry (bsc#1267484).
  • CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause that memory to be copied into telemetry (bsc#1267486).
  • CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled writev buffers and allows multi-segment calls to read and overwrite memory beyond the first segment (bsc#1267487).
  • CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer (bsc#1272418).
  • CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent (bsc#1268982).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).
  • CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278671).
  • CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).
  • CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage (bsc#1276992).
  • CVE-2026-75889: arbitrary file reads due to the prometheus.operator.servicemonitors component allowing users who can modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile (bsc#1277429).
  • CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in Client.BulkWrite (bsc#1278693).
  • CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames containing a crafted header value type byte outside the valid range can cause the host process to terminate (bsc#1280671).

Changes for alloy:

Update to version 1.19.2:

  • Remove withdrawn lib/pq CVEs from govulncheck
  • Add backticks to component name in generated doc output
  • BREAKING CHANGE: prometheus.operator.servicemonitors now rejects endpoints that reference local files by default. Set allow_arbitrary_file_access = true to preserve previous behavior.
  • prometheus.enrich: Support multi-label matching
  • prometheus.relabel: Add opt-in TTL cache mode
  • telemetry: Add new metrics for graph connections and pyroscope forwarded entries
  • database_observability: Exclude system schemas from MySQL health checks and redact query text in explain_plans
  • Add nop receiver to OTel Engine
  • Backport dependency upgrades to address GO-2026-6061
Record
SUSE-SU-2026:24148-1
Updated
2026-11-02
OSVSUSE-SU-2026:3916-1 No score

Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls

This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the following issues:

  • CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of truncated/invalid UTF-8 input can lead to infinite loop (bsc#1271995, bsc#1272078, bsc#1272090).
  • CVE-2026-71556: github.com/go-git/go-git/v5: symlink traversal issue in worktree operations allows for arbitrary file reads/writes (bsc#1276978).
  • CVE-2026-71557: github.com/go-git/go-git/v5: improper reference name sanitization before construction of on-disk paths under the reference storage directory can lead to arbitrary file writes (bsc#1276987).
Record
SUSE-SU-2026:3916-1
Updated
2026-11-02
OSVSUSE-SU-2026:4082-1 No score

Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issues:

  • CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276981).
  • CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage (bsc#1276994).

Changes for amazon-ssm-agent:

  • Update to version 3.3.5226.0
Record
SUSE-SU-2026:4082-1
Updated
2026-11-02
OSVSUSE-SU-2026:4286-1 No score

Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issues:

  • CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1278681)
  • CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1278681)
  • CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1278681).
  • CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276981).
  • CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage (bsc#1276994).

Changes for amazon-ssm-agent:

  • Update to version 3.3.5390.0
Record
SUSE-SU-2026:4286-1
Updated
2026-11-02
OSVSUSE-SU-2026:4408-1 No score

Security update for alloy

This update for alloy fixes the following issues:

  • CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling (bsc#1269861).
  • CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276742).
  • CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to exfiltration of sensitive data (bsc#1267482).
  • CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS (bsc#1267483).
  • CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI out-of-bounds reads to leak memory into telemetry (bsc#1267484).
  • CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause that memory to be copied into telemetry (bsc#1267486).
  • CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled writev buffers and allows multi-segment calls to read and overwrite memory beyond the first segment (bsc#1267487).
  • CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer (bsc#1272418).
  • CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent (bsc#1268982).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).
  • CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278671).
  • CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).
  • CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage (bsc#1276992).
  • CVE-2026-75889: arbitrary file reads due to the prometheus.operator.servicemonitors component allowing users who can modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile (bsc#1277429).
  • CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in Client.BulkWrite (bsc#1278693).
  • CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames containing a crafted header value type byte outside the valid range can cause the host process to terminate (bsc#1280671).

Changes for alloy:

  • Update to version 1.19.2.
  • Update to version 1.19.1.
  • Update to version 1.19.0:
  • BREAKING CHANGE: prometheus.operator.servicemonitors now rejects endpoints that reference local files by default. Set allow_arbitrary_file_access = true to preserve previous behavior.
  • prometheus.enrich: Support multi-label matching
  • prometheus.relabel: Add opt-in TTL cache mode
  • telemetry: Add new metrics for graph connections and pyroscope forwarded entries
  • database_observability: Exclude system schemas from MySQL health checks and redact query text in explain_plans
  • Update to version 1.18.1:
  • Add nop receiver to OTel Engine
Record
SUSE-SU-2026:4408-1
Updated
2026-11-02
OSVSUSE-SU-2026:4628-1 No score

Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls

This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the following issues:

Security issues fixed:

  • CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267271 bsc#1267273 bsc#1267276).
  • CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278462 bsc#1278477 bsc#1278505).
  • CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276980).
  • CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage (bsc#1276990).
  • CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278269 bsc#1279243 bsc#1279245 bsc#1279252 bsc#1279263 bsc#1279386).
  • CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278272 bsc#1279072 bsc#1279080 bsc#1279137).
  • CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278742 bsc#1278743 bsc#1278751 bsc#1278763).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1278267).

Non security issue fixed:

  • terraform-provider-{aws,external,google,random,tls}: aarch64 build installs provider binary under linux_amd64 instead of linux_arm64, breaking terraform init (bsc#1280175).
Record
SUSE-SU-2026:4628-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/go-git/go-git/v5
Go
 through 5.19.1
5.19.2
github.com/go-git/go-git/v6
Go
 through 6.0.0-alpha.4
6.0.0-alpha.5
cri-o
Azure Linux:3
 through 1.30.1-1 None known
packer
Azure Linux:3
 before 1.9.5-20
1.9.5-20
golang-github-go-git-go-git
Debian:12
 All versions, plus listed versions
5.11.0-15.11.0-25.11.0-35.11.0-45.12.0-1
Show 9 moreShow less
5.13.2-15.14.0-15.16.2-15.17.0-15.17.1-15.19.1-15.19.2-15.4.2-35.4.2-4
 None known
golang-github-go-git-go-git
Debian:13
 All versions, plus listed versions
5.14.0-15.16.2-15.17.0-15.17.1-15.19.1-15.19.2-1
 None known
golang-github-go-git-go-git
Debian:14
 before 5.19.2-1, plus listed versions
5.14.0-15.16.2-15.17.0-15.17.1-15.19.1-1
5.19.2-1
golang-github-go-git-go-git-v6
Debian:14
 before 6.0.0~alpha.5-1, plus listed versions
6.0.0~alpha.4-16.0.0~alpha.4-26.0.0~alpha4-16.0.0~alpha4-26~git20260305.2083cf94-16~git20260305.2083cf94-26~git20260305.2083cf94-3
6.0.0~alpha.5-1
github.com/go-git/go-git/v5
Go
 before 5.19.2
5.19.2
github.com/go-git/go-git/v6
Go
 before 6.0.0-alpha.5
6.0.0-alpha.5
Show 63 moreShow less
Affected packages
PackageAffectedFixed
kube-state-metrics
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:2.20.0-0.2.hum1
0:2.20.0-0.2.hum1
trivy
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:0.74.0-0.3.hum1
0:0.74.0-0.3.hum1
grype
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:0.119.0-0.1.hum1
0:0.119.0-0.1.hum1
syft
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.52.0-0.1.hum1
0:1.52.0-0.1.hum1
govulncheck-vulndb
SUSE:Linux Enterprise Server 16.0
From an advisory covering 181 CVEs
 before 0.0.20260827T195228-160000.1.1
0.0.20260827T195228-160000.1.1
govulncheck-vulndb
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 181 CVEs
 before 0.0.20260827T195228-160000.1.1
0.0.20260827T195228-160000.1.1
alloy
SUSE:Linux Enterprise Server 16.0
From an advisory covering 19 CVEs
 before 1.19.2-160000.1.1
1.19.2-160000.1.1
alloy
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 19 CVEs
 before 1.19.2-160000.1.1
1.19.2-160000.1.1
terraform-provider-aws
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 3 CVEs
 before 3.11.0-150200.6.24.2
3.11.0-150200.6.24.2
terraform-provider-azurerm
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 3 CVEs
 before 2.32.0-150200.6.18.2
2.32.0-150200.6.18.2
terraform-provider-external
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 3 CVEs
 before 2.0.0-150200.6.18.2
2.0.0-150200.6.18.2
terraform-provider-google
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 3 CVEs
 before 3.43.0-150200.6.18.2
3.43.0-150200.6.18.2
terraform-provider-helm
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 3 CVEs
 before 2.9.0-150200.6.29.2
2.9.0-150200.6.29.2
terraform-provider-kubernetes
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 3 CVEs
 before 1.13.2-150200.6.18.2
1.13.2-150200.6.18.2
terraform-provider-local
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 3 CVEs
 before 2.0.0-150200.6.25.1
2.0.0-150200.6.25.1
terraform-provider-null
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 3 CVEs
 before 3.0.0-150200.6.24.2
3.0.0-150200.6.24.2
terraform-provider-random
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 3 CVEs
 before 3.0.0-150200.6.21.2
3.0.0-150200.6.21.2
terraform-provider-tls
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 3 CVEs
 before 3.0.0-150200.5.21.2
3.0.0-150200.5.21.2
terraform-provider-aws
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 3 CVEs
 before 3.11.0-150200.6.24.2
3.11.0-150200.6.24.2
terraform-provider-azurerm
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 3 CVEs
 before 2.32.0-150200.6.18.2
2.32.0-150200.6.18.2
terraform-provider-external
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 3 CVEs
 before 2.0.0-150200.6.18.2
2.0.0-150200.6.18.2
terraform-provider-google
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 3 CVEs
 before 3.43.0-150200.6.18.2
3.43.0-150200.6.18.2
terraform-provider-helm
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 3 CVEs
 before 2.9.0-150200.6.29.2
2.9.0-150200.6.29.2
terraform-provider-kubernetes
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 3 CVEs
 before 1.13.2-150200.6.18.2
1.13.2-150200.6.18.2
terraform-provider-local
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 3 CVEs
 before 2.0.0-150200.6.25.1
2.0.0-150200.6.25.1
terraform-provider-null
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 3 CVEs
 before 3.0.0-150200.6.24.2
3.0.0-150200.6.24.2
terraform-provider-random
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 3 CVEs
 before 3.0.0-150200.6.21.2
3.0.0-150200.6.21.2
terraform-provider-tls
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 3 CVEs
 before 3.0.0-150200.5.21.2
3.0.0-150200.5.21.2
amazon-ssm-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 2 CVEs
 before 3.3.5226.0-150000.5.40.1
3.3.5226.0-150000.5.40.1
amazon-ssm-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 2 CVEs
 before 3.3.5226.0-150000.5.40.1
3.3.5226.0-150000.5.40.1
amazon-ssm-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP6
From an advisory covering 2 CVEs
 before 3.3.5226.0-150000.5.40.1
3.3.5226.0-150000.5.40.1
amazon-ssm-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP7
From an advisory covering 2 CVEs
 before 3.3.5226.0-150000.5.40.1
3.3.5226.0-150000.5.40.1
amazon-ssm-agent
SUSE:Linux Enterprise Module for Public Cloud 12
From an advisory covering 5 CVEs
 before 3.3.5390.0-4.52.1
3.3.5390.0-4.52.1
alloy
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 19 CVEs
 before 1.19.2-150700.15.29.1
1.19.2-150700.15.29.1
terraform-provider-aws
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 9 CVEs
 before 3.11.0-150200.6.29.2
3.11.0-150200.6.29.2
terraform-provider-azurerm
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 9 CVEs
 before 2.32.0-150200.6.23.2
2.32.0-150200.6.23.2
terraform-provider-external
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 9 CVEs
 before 2.0.0-150200.6.23.2
2.0.0-150200.6.23.2
terraform-provider-google
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 9 CVEs
 before 3.43.0-150200.6.23.2
3.43.0-150200.6.23.2
terraform-provider-helm
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 9 CVEs
 before 2.9.0-150200.6.34.2
2.9.0-150200.6.34.2
terraform-provider-kubernetes
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 9 CVEs
 before 1.13.2-150200.6.23.2
1.13.2-150200.6.23.2
terraform-provider-local
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 9 CVEs
 before 2.0.0-150200.6.30.2
2.0.0-150200.6.30.2
terraform-provider-null
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 9 CVEs
 before 3.0.0-150200.6.32.2
3.0.0-150200.6.32.2
terraform-provider-random
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 9 CVEs
 before 3.0.0-150200.6.26.2
3.0.0-150200.6.26.2
terraform-provider-tls
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 9 CVEs
 before 3.0.0-150200.5.26.2
3.0.0-150200.5.26.2
terraform-provider-aws
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 9 CVEs
 before 3.11.0-150200.6.29.2
3.11.0-150200.6.29.2
terraform-provider-azurerm
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 9 CVEs
 before 2.32.0-150200.6.23.2
2.32.0-150200.6.23.2
terraform-provider-external
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 9 CVEs
 before 2.0.0-150200.6.23.2
2.0.0-150200.6.23.2
terraform-provider-google
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 9 CVEs
 before 3.43.0-150200.6.23.2
3.43.0-150200.6.23.2
terraform-provider-helm
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 9 CVEs
 before 2.9.0-150200.6.34.2
2.9.0-150200.6.34.2
terraform-provider-kubernetes
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 9 CVEs
 before 1.13.2-150200.6.23.2
1.13.2-150200.6.23.2
terraform-provider-local
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 9 CVEs
 before 2.0.0-150200.6.30.2
2.0.0-150200.6.30.2
terraform-provider-null
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 9 CVEs
 before 3.0.0-150200.6.32.2
3.0.0-150200.6.32.2
terraform-provider-random
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 9 CVEs
 before 3.0.0-150200.6.26.2
3.0.0-150200.6.26.2
terraform-provider-tls
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 9 CVEs
 before 3.0.0-150200.5.26.2
3.0.0-150200.5.26.2
golang-github-go-git-go-git
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
5.4.2-35.4.2-3ubuntu0.1~esm15.4.2-3ubuntu0.1~esm2
 None known
golang-github-go-git-go-git
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
5.4.2-3build15.4.2-45.4.2-4ubuntu0.24.04.15.4.2-4ubuntu0.24.04.25.4.2-4ubuntu0.24.04.2+esm1
Show 4 moreShow less
5.4.2-4ubuntu0.24.04.35.4.2-4ubuntu0.24.04.3+esm15.4.2-4ubuntu0.24.04.3+esm25.4.2-4ubuntu0.24.04.3+esm3
 None known
golang-github-go-git-go-git
Ubuntu:26.10
 All versions, plus listed versions
5.16.2-15.19.1-15.19.2-1
 None known
golang-github-go-git-go-git-v6
Ubuntu:26.10
 All versions, plus listed versions
6.0.0~alpha.4-16.0.0~alpha.4-26.0.0~alpha.5-16.0.0~alpha.5-2
 None known
golang-github-go-git-go-git
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
5.14.0-15.16.2-15.16.2-1ubuntu0.1~esm1
 None known
alloy
openSUSE:Tumbleweed
From an advisory covering 18 CVEs
 before 1.19.2-1.1
1.19.2-1.1
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 181 CVEs
 before 0.0.20260827T195228-160000.1.1
0.0.20260827T195228-160000.1.1
amazon-ssm-agent
openSUSE:Leap 16.0
From an advisory covering 5 CVEs
 before 3.3.5390.0-160000.1.1
3.3.5390.0-160000.1.1
alloy
openSUSE:Leap 16.0
From an advisory covering 19 CVEs
 before 1.19.2-160000.1.1
1.19.2-160000.1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubSaku0512/CVE-2026-71557-poc2026-08-08
PoC in GitHubSaku0512/reprokit-go-git-cve-2026-71557-lab2026-10-18

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-71557 is a medium vulnerability (CVSS 6.3) in Go-git, published August 7, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in github.com/go-git/go-git/v5 5.19.2.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 102 references and the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open