Description
go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| go-git | go-git | >= 4.0.0, < 5.13.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-go-git-go-git | 5.13.2-1 | — |
| Debian 13 | golang-github-go-git-go-git | 5.13.2-1 | — |
| Debian 12 | golang-github-go-git-go-git | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | golang-github-go-git-go-git | 5.4.2-4ubuntu0.24.04.3+esm2 | USN-8088-1 |
| Ubuntu Pro 22.04 LTS | golang-github-go-git-go-git | 5.4.2-3ubuntu0.1~esm1 | USN-8088-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | grafana +1 | 9.2.10-21.el8_10 | RHSA-2025:0401 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | grafana +1 | 9.2.10-21.el9_4 | RHSA-2025:0662 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | grafana +1 | 9.2.10-21.el8_10 | ALSA-2025:0401 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | grafana | 9.2.10-21.el8_10 | RLSA-2025:0401 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | govulncheck-vulndb | 0.0.20250108T191942-150000.1.26.1 | SUSE-SU-2025:0060-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP6 | trivy | 0.58.2-bp156.2.6.1 | openSUSE-SU-2025:0056-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cheat | 4.4.2-2.1 | openSUSE-SU-2025:15487-1 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250108T191942-1.1 | openSUSE-SU-2025:14624-1 |
| openSUSE Tumbleweed | operator-sdk | 1.39.0-1.1 | openSUSE-SU-2025:14634-1 |
| openSUSE Leap 16.0 | cheat | 4.4.2-bp160.2.1 | openSUSE-SU-2025:20177-1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20250108T191942-150000.1.26.1 | SUSE-SU-2025:0060-1 |
| openSUSE Leap 15.6 | trivy | 0.58.2-bp156.2.6.1 | openSUSE-SU-2025:0056-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | amazon-ssm-agent | 3.3.1611.0-1.amzn2023 | ALAS2023-2025-824 |
| Amazon Linux 2 | amazon-ssm-agent | 3.3.1611.0-1.amzn2 | ALAS2-2025-2739 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cri-o | No fix yet | — |
| Azure Linux 3 | packer | 1.9.5-5 | — |
| Azure Linux 2 (CBL-Mariner) | cri-o | 1.22.3-14 | — |
| Azure Linux 2 (CBL-Mariner) | packer | 1.9.5-7 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | grafana +1 | 9.2.10-21.el8_10 | ELSA-2025-0401 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | apko | 0.22.5-r0 | — |
| Wolfi rolling | argo-events | 1.9.3-r3 | — |
| Wolfi rolling | argo-workflows | 3.6.2-r4 | — |
| Wolfi rolling | argocd-image-updater +1 | 0.15.2-r1 | — |
| Wolfi rolling | bom | 0.6.0-r14 | — |
| Wolfi rolling | chezmoi | 2.57.0-r1 | — |
| Wolfi rolling | crossplane-crank | 1.18.2-r2 | — |
| Wolfi rolling | dagger | 0.15.1-r3 | — |
| Wolfi rolling | flux | 2.4.0-r3 | — |
| Wolfi rolling | flux-image-automation-controller +2 | 0.39.0-r5 | — |
| Wolfi rolling | flux-kustomize-controller +1 | 1.4.0-r4 | — |
| Wolfi rolling | flux-source-controller +1 | 1.4.1-r6 | — |
| Wolfi rolling | gitea +1 | 1.22.6-r2 | — |
| Wolfi rolling | gitsign +2 | 0.12.0-r1 | — |
| Wolfi rolling | go-licenses | 1.6.0-r20 | — |
| Wolfi rolling | goreleaser | 2.5.1-r1 | — |
| Wolfi rolling | gptscript | 0.9.5-r4 | — |
| Wolfi rolling | grafana-alloy | 1.5.1-r3 | — |
| Wolfi rolling | grype | 0.86.1-r2 | — |
| Wolfi rolling | guac +4 | 0.12.4-r1 | — |
| Wolfi rolling | k8sgpt | 0.3.48-r3 | — |
| Wolfi rolling | k9s | 0.32.7-r3 | — |
| Wolfi rolling | kaniko +3 | 1.23.2-r8 | — |
| Wolfi rolling | kargo +1 | 1.1.2-r1 | — |
| Wolfi rolling | kots +2 | 1.123.0-r1 | — |
| Wolfi rolling | kubescape | 3.0.22-r3 | — |
| Wolfi rolling | kubevela +3 | 1.9.13-r6 | — |
| Wolfi rolling | melange | 0.18.3-r1 | — |
| Wolfi rolling | nuclei | 3.3.7-r3 | — |
| Wolfi rolling | osv-scanner | 1.9.2-r1 | — |
| Wolfi rolling | pulumi +3 | 3.145.0-r0 | — |
| Wolfi rolling | pulumi-kubernetes-operator | 1.16.0-r6 | — |
| Wolfi rolling | pulumi-language-dotnet | 3.71.1-r2 | — |
| Wolfi rolling | pulumi-language-java | 1.6.0-r1 | — |
| Wolfi rolling | pulumi-language-yaml | 1.13.0-r3 | — |
| Wolfi rolling | scorecard | 5.0.0-r5 | — |
| Wolfi rolling | skaffold | 2.13.2-r5 | — |
| Wolfi rolling | snyk-cli | 1.1294.3-r2 | — |
| Wolfi rolling | src-fingerprint | 0.19.0-r21 | — |
| Wolfi rolling | syft | 1.18.1-r2 | — |
| Wolfi rolling | task | 3.40.1-r3 | — |
| Wolfi rolling | tfsec | 1.28.12-r1 | — |
| Wolfi rolling | timoni | 0.23.0-r3 | — |
| Wolfi rolling | trivy | 0.58.1-r1 | — |
| Wolfi rolling | wolfictl | 0.27.5-r0 | — |
| Wolfi rolling | zarf | 0.45.0-r3 | — |
| Wolfi rolling | zot | 2.1.1-r8 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/go-git/go-git | >= 4.0.0, <= 4.13.1 | — | GHSA-r9px-m959-cxf4 |
| Go | github.com/go-git/go-git/v4 | >= 4.0.0 | — | GO-2025-3367 |
| Go | github.com/go-git/go-git/v5 | < 5.13.0 | 5.13.0 | GHSA-r9px-m959-cxf4 |
| Go | gopkg.in/src-d/go-git.v4 | >= 4.0.0, <= 4.13.1 | — | GHSA-r9px-m959-cxf4 |
| Go | gopkg.in/src-d/go-git.v4 | >= 4.0.0 | — | GO-2025-3367 |
Advisories 15
- ALSA-2025:0401 Important: grafana security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:0401 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:0662 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- WID-SEC-2025-0123 Red Hat Enterprise Linux und and OpenShift (go-git): Mehrere Schwachstellen BSI CERT-Bund (WID) · May 18, 2026
- USN-8088-1 golang-github-go-git-go-git vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- openSUSE-SU-2025:20177-1 Security update for cheat SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15487-1 cheat-4.4.2-2.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- RLSA-2025:0401 Important: grafana security update Rocky Linux Security Advisories · Feb 5, 2026
- SUSE-SU-2025:0060-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Feb 5, 2026
- openSUSE-SU-2025:14634-1 operator-sdk-1.39.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14624-1 govulncheck-vulndb-0.0.20250108T191942-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:0056-1 Security update for trivy SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2023-2025-824 Important: amazon-ssm-agent security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 5, 2025
- ALAS2-2025-2739 Important: amazon-ssm-agent security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 4, 2025
- ELSA-2025-0401 Important: grafana security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jan 19, 2025