Skip to content
OpenAdvisories
Critical USN-8088-1 5 CVEs

golang-github-go-git-go-git vulnerabilities

Published Mar 12, 2026 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Ionut Lalu discovered that go-git incorrectly handled certain specially
crafted Git server responses. An attacker could possibly use this issue to
cause a denial of service. (CVE-2023-49568, CVE-2025-21614)

Ionut Lalu discovered that go-git incorrectly handled file system paths
when using the ChrootOS implementation. A remote attacker could possibly
use this issue to perform a path traversal and create or modify arbitrary
files, leading to remote code execution. (CVE-2023-49569)

It was discovered that go-git did not properly sanitize arguments when
invoking git-upload-pack using the file transport protocol. An attacker
could possibly use this issue to inject arbitrary flag values when
interacting with local Git repositories. (CVE-2025-21613)

It was discovered that go-git did not properly verify integrity checks for
pack and index files. An attacker could possibly use this issue to cause
go-git to process corrupted repository data, resulting in unexpected errors
or an incorrect repository state. (CVE-2026-25934)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS golang-github-go-git-go-git 5.4.2-3ubuntu0.1~esm1
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS golang-github-go-git-go-git 5.4.2-4ubuntu0.24.04.3+esm2

Vulnerabilities 5

  • Critical 9.8
    CVE-2023-49569

    Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients

    A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved. Applications are only …

    go-git go-git scorecard nuclei Debian Ubuntu Azure Linux Wolfi Go
  • Critical 9.2
    CVE-2025-21613

    go-git has an Argument Injection via the URL field

    go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to…

    go-git go-git zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  • High 7.5
    CVE-2023-49568

    Maliciously crafted Git server replies can cause DoS on go-git clients

    A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion …

    go-git go-git zot kots Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2025-21614

    go-git clients vulnerable to DoS via maliciously crafted Git server replies

    go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing spec…

    go-git go-git zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  • Medium 4.3
    CVE-2026-25934

    go-git improperly verifies data integrity values for .idx and .pack files

    go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consu…

    go-git go-git zot kubescape Debian Ubuntu Wolfi Go

References

  • report
    https://ubuntu.com/security/CVE-2023-49568
  • report
    https://ubuntu.com/security/CVE-2023-49569
  • report
    https://ubuntu.com/security/CVE-2025-21613
  • report
    https://ubuntu.com/security/CVE-2025-21614
  • report
    https://ubuntu.com/security/CVE-2026-25934