Go-git vulnerabilities

Products

• Go-git 13
• Go-billy 2

Newest

• go-git go-git: Malicious reference names may modify files outside the reference storage CVE-2026-71557 Public exploitFix available 6.3 MediumAugust 7, 2026
• go-git go-git: Worktree operations may follow symlinks CVE-2026-71556 Fix available 7.1 HighAugust 7, 2026
• go-git go-git: Crafted repositories may modify main and submodule .git directories CVE-2026-45571 Fix available 5.4 MediumMay 19, 2026
• go-git go-git: Improper single-quote escaping in go-git SSH transport CVE-2026-45570 Fix available 2.3 LowMay 19, 2026
• go-git go-billy Billy: Path traversal vulnerabilities CVE-2026-44973 Fix available 8.1 HighMay 14, 2026
• go-git go-billy go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion CVE-2026-44740 Fix available 6.5 MediumMay 13, 2026
• go-git go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git CVE-2026-45022 Fix available 7.0 HighMay 11, 2026
• go-git go-git Credential leak via cross-host redirect in smart HTTP transport CVE-2026-41506 Fix available 4.7 MediumApril 17, 2026
• go-git go-git: Maliciously crafted idx file can cause asymmetric memory consumption CVE-2026-34165 Fix available 5.0 MediumMarch 30, 2026
• go-git go-git: Missing validation decoding Index v4 files leads to panic CVE-2026-33762 Fix available 2.8 LowMarch 30, 2026
• go-git go-git improperly verifies data integrity values for .idx and .pack files CVE-2026-25934 Fix available 4.3 MediumFebruary 9, 2026
• go-git go-git clients vulnerable to DoS via maliciously crafted Git server replies CVE-2025-21614 Fix available 7.5 HighJanuary 6, 2025
• go-git go-git has an Argument Injection via the URL field CVE-2025-21613 Fix available 9.2 CriticalJanuary 6, 2025
• go-git Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients CVE-2023-49569 Fix available 9.8 CriticalJanuary 10, 2024
• go-git Maliciously crafted Git server replies can cause DoS on go-git clients CVE-2023-49568 Fix available 7.5 HighDecember 27, 2023