Description
A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients.
Applications using only the in-memory filesystem supported by go-git are not affected by this vulnerability.
This is a go-git implementation issue and does not affect the upstream git cli.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| go-git | go-git | 5.11.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-go-git-go-git | 5.11.0-1 | — |
| Debian 13 | golang-github-go-git-go-git | 5.11.0-1 | — |
| Debian 12 | golang-github-go-git-go-git | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | golang-github-go-git-go-git | 5.4.2-4ubuntu0.24.04.3+esm2 | USN-8088-1 |
| Ubuntu Pro 22.04 LTS | golang-github-go-git-go-git | 5.4.2-3ubuntu0.1~esm1 | USN-8088-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Serverless 1 | openshift-serverless-clients | 1.10.0-6.el8 | RHSA-2024:0880 |
| Red Hat Ceph Storage 7 | ceph +25 | 2:18.2.1-194.el8cp | RHSA-2024:3925 |
| Red Hat Ceph Storage 7 | cephadm | 2:18.2.1-194.el9cp | RHSA-2024:3925 |
| Red Hat Ceph Storage 7 | cephadm-ansible | 1:3.2.0-1.el9cp | RHSA-2024:3925 |
| Red Hat Ceph Storage 7 | gperftools +1 | 1:2.7-9.el8cp | RHSA-2024:3925 |
| Red Hat Ceph Storage 7 | liboath +1 | 2.6.2-3.el8cp | RHSA-2024:3925 |
| Red Hat Ceph Storage 7 | libunwind | 1.3.1-3.el8cp | RHSA-2024:3925 |
| Red Hat Ceph Storage 7 | thrift | 0.13.0-2.el8cp | RHSA-2024:3925 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | nfpm | 2.35.2-r0 | — |
| Alpine v3.23 | nfpm | 2.35.2-r0 | — |
| Alpine v3.22 | nfpm | 2.35.2-r0 | — |
| Alpine v3.21 | nfpm | 2.35.2-r0 | — |
| Alpine v3.20 | nfpm | 2.35.2-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | amazon-ssm-agent | 3.2.2222.0-1.amzn2023 | ALAS2023-2024-526 |
| Amazon Linux 2 | amazon-ssm-agent | 3.2.2222.0-1.amzn2 | ALAS2-2024-2458 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | packer | 1.9.5-1 | — |
| Azure Linux 2 (CBL-Mariner) | cri-o | 1.22.3-12 | — |
| Azure Linux 2 (CBL-Mariner) | packer | 1.9.5-3 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | apko | 0.13.2-r0 | — |
| Wolfi rolling | bom | 0.6.0-r0 | — |
| Wolfi rolling | flux-kustomize-controller | 1.2.1-r2 | — |
| Wolfi rolling | gitness | 3.0.0_beta5-r0 | — |
| Wolfi rolling | gitsign +2 | 0.8.1-r0 | — |
| Wolfi rolling | go-licenses | 1.6.0-r9 | — |
| Wolfi rolling | gomplate | 3.11.6-r3 | — |
| Wolfi rolling | goreleaser | 1.24.0-r0 | — |
| Wolfi rolling | kots | 1.104.7-r2 | — |
| Wolfi rolling | kubevela | 1.9.7-r4 | — |
| Wolfi rolling | nuclei | 3.2.0-r0 | — |
| Wolfi rolling | pulumi | 3.99.0-r2 | — |
| Wolfi rolling | pulumi-kubernetes-operator | 1.14.0-r4 | — |
| Wolfi rolling | pulumi-language-dotnet | 3.59.0-r3 | — |
| Wolfi rolling | pulumi-language-java | 0.9.9-r1 | — |
| Wolfi rolling | pulumi-language-yaml | 1.4.5-r1 | — |
| Wolfi rolling | scorecard | 4.13.1-r4 | — |
| Wolfi rolling | src-fingerprint | 0.19.0-r9 | — |
| Wolfi rolling | zot | 2.0.0-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/go-git/go-git/v5 | < 5.11.0 | 5.11.0 | GHSA-mw99-9chc-xw7r |
| Go | github.com/go-git/go-git/v5 | >= 5.0.0, < 5.11.0 | 5.11.0 | GO-2024-2466 |
| Go | gopkg.in/src-d/go-git.v4 | >= 4.7.1, <= 4.13.1 | — | GHSA-mw99-9chc-xw7r |
| Go | gopkg.in/src-d/go-git.v4 | >= 4.7.1 | — | GO-2024-2466 |
Advisories 7
- RHSA-2024:0880 Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.31.1 security update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- RHSA-2024:3925 Red Hat Security Advisory: Red Hat Ceph Storage 7.1 security, enhancements, and bug fix update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- USN-8088-1 golang-github-go-git-go-git vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- WID-SEC-2024-0521 IBM MQ: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 15, 2024
- WID-SEC-2024-0158 Red Hat Advanced Cluster Management for Kubernetes: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 3, 2024
- ALAS2-2024-2458 Important: amazon-ssm-agent security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 24, 2024
- ALAS2023-2024-526 Important: amazon-ssm-agent security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 29, 2024