Description
go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing. This issue only affects Git index format version 4. Earlier formats (go-git supports only v2 and v3) are not vulnerable to this issue. This issue has been patched in version 5.17.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| go-git | go-git | < 5.17.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-go-git-go-git | 5.17.1-1 | — |
| Debian 13 | golang-github-go-git-go-git | No fix yet | — |
| Debian 12 | golang-github-go-git-go-git | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-github-go-git-go-git | No fix yet | — |
| Ubuntu 25.10 | golang-github-go-git-go-git | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | golang-github-go-git-go-git | No fix yet | — |
| Ubuntu Pro 24.04 LTS | golang-github-go-git-go-git | No fix yet | — |
| Ubuntu Pro 22.04 LTS | golang-github-go-git-go-git | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | apko | 1.2.0-r1 | — |
| Wolfi rolling | argo-cd-3.2 +1 | 3.2.8-r1 | — |
| Wolfi rolling | argo-cd-3.3 +1 | 3.3.6-r2 | — |
| Wolfi rolling | argo-events | 1.9.10-r14 | — |
| Wolfi rolling | argo-workflows-3.7 +1 | 3.7.12-r2 | — |
| Wolfi rolling | argo-workflows-4.0 +1 | 4.0.3-r2 | — |
| Wolfi rolling | argocd-image-updater | 1.1.1-r5 | — |
| Wolfi rolling | bom | 0.7.1-r11 | — |
| Wolfi rolling | cerbos +1 | 0.51.0-r10 | — |
| Wolfi rolling | chezmoi | 2.70.0-r1 | — |
| Wolfi rolling | crossplane-2.2-crank | 2.2.0-r5 | — |
| Wolfi rolling | dagger | 0.20.3-r1 | — |
| Wolfi rolling | flux-2.7 | 2.7.5-r11 | — |
| Wolfi rolling | flux-2.8 | 2.8.3-r3 | — |
| Wolfi rolling | flux-image-automation-controller | 1.1.1-r9 | — |
| Wolfi rolling | flux-source-controller | 1.8.1-r3 | — |
| Wolfi rolling | gitaly-18.10 | 18.10.2-r1 | — |
| Wolfi rolling | gitaly-18.11 | 18.11.6-r5 | — |
| Wolfi rolling | gitaly-18.6 +2 | No fix yet | — |
| Wolfi rolling | gitaly-18.8 | 18.8.8-r1 | — |
| Wolfi rolling | gitaly-18.9 | 18.9.4-r1 | — |
| Wolfi rolling | gitea | 1.25.5-r3 | — |
| Wolfi rolling | gitlab-runner-18.10 +1 | 18.10.1-r1 | — |
| Wolfi rolling | gitlab-runner-18.6 +1 | 18.6.6-r6 | — |
| Wolfi rolling | gitlab-runner-18.7 +1 | 18.7.2-r10 | — |
| Wolfi rolling | gitlab-runner-18.8 +1 | 18.8.0-r6 | — |
| Wolfi rolling | gitlab-runner-18.9 +1 | 18.9.0-r6 | — |
| Wolfi rolling | gitsign | 0.14.0-r12 | — |
| Wolfi rolling | gomplate-5 | 5.0.0-r13 | — |
| Wolfi rolling | gptscript | 0.9.9-r280 | — |
| Wolfi rolling | grafana-alloy | 1.15.0-r2 | — |
| Wolfi rolling | grype | 0.110.0-r1 | — |
| Wolfi rolling | guac +2 | 1.1.0-r5 | — |
| Wolfi rolling | k9s | 0.50.18-r13 | — |
| Wolfi rolling | kaniko | 1.25.12-r3 | — |
| Wolfi rolling | kargo | 1.9.5-r7 | — |
| Wolfi rolling | kots | 1.129.4-r5 | — |
| Wolfi rolling | kubescape | 4.0.5-r0 | — |
| Wolfi rolling | kubevela-vela-cli +1 | 1.10.7-r6 | — |
| Wolfi rolling | kyverno-cli-1.17 | 1.17.1-r8 | — |
| Wolfi rolling | melange | 0.47.0-r1 | — |
| Wolfi rolling | nfpm | 2.45.2-r4 | — |
| Wolfi rolling | nuclei | 3.7.1-r5 | — |
| Wolfi rolling | osv-scanner | 2.3.6-r0 | — |
| Wolfi rolling | pulumi +3 | 3.229.0-r2 | — |
| Wolfi rolling | pulumi-kubernetes-operator | 2.6.0-r1 | — |
| Wolfi rolling | pulumi-language-dotnet | 3.102.0-r3 | — |
| Wolfi rolling | pulumi-language-java | 1.21.3-r4 | — |
| Wolfi rolling | pulumi-language-yaml | 1.30.1-r3 | — |
| Wolfi rolling | rancher-fleet-cli | 0.15.0-r1 | — |
| Wolfi rolling | scorecard | 5.4.0-r15 | — |
| Wolfi rolling | skaffold | 2.18.2-r2 | — |
| Wolfi rolling | snyk-cli | 1.1303.2-r1 | — |
| Wolfi rolling | src-fingerprint | 0.19.0-r53 | — |
| Wolfi rolling | steampipe | 2.4.1-r0 | — |
| Wolfi rolling | syft | 1.42.3-r1 | — |
| Wolfi rolling | teleport-18.6 | 18.6.8-r9 | — |
| Wolfi rolling | tfsec | 1.28.14-r24 | — |
| Wolfi rolling | trivy | 0.69.3-r6 | — |
| Wolfi rolling | trivy-operator | 0.30.1-r4 | — |
| Wolfi rolling | trufflehog | 3.94.1-r1 | — |
| Wolfi rolling | witness | 0.10.2-r16 | — |
| Wolfi rolling | wolfictl | 0.39.7-r1 | — |
| Wolfi rolling | xeol | 0.10.8-r30 | — |
| Wolfi rolling | zarf | 0.74.0-r2 | — |
| Wolfi rolling | zot | 2.1.15-r6 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/go-git/go-git | all versions | — | GO-2026-4909 |
| Go | github.com/go-git/go-git/v4 | all versions | — | GO-2026-4909 |
| Go | github.com/go-git/go-git/v5 | < 5.17.1 | 5.17.1 | GHSA-gm2x-2g9h-ccm8 |
Advisories 1
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026