https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T12:51:27.340899+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/bdu:2026-11021 bdu:2026-11021 2026-10-01T12:51:27.419123+00:00 bdu:2026-11021 https://vulnerability.circl.lu/vuln/cleanstart-2026-ad69953 Withdrawn: CLEANSTART-2026-AD69953 — Security fixes in argo-cd-fips 3.1.14-r0 2026-10-01T12:51:27.419190+00:00

Withdrawn by the publisher.

Affected: CleanStart: argo-cd-fips

Package argo-cd-fips version 3.1.14-r0 fixes 14 vulnerabilities: ghsa-mh2q-q3fh-2475, ghsa-p77j-4mvh-x3m3, ghsa-pc3f-x583-g7j2, ghsa-78h2-9frx-2jm8, ghsa-hfvc-g4fc-pqhx...

 https://vulnerability.circl.lu/vuln/fkie_cve-2026-33762 fkie_cve-2026-33762 2026-10-01T12:51:27.419245+00:00

go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing. This issue only affects Git index format version 4. Earlier formats (go-git supports only v2 and v3) are not vulnerable to this issue. This issue has been patched in version 5.17.1.

 https://vulnerability.circl.lu/vuln/ghsa-gm2x-2g9h-ccm8 GHSA-gm2x-2g9h-ccm8 — go-git missing validation decoding Index v4 files leads to panic 2026-10-01T12:51:27.419287+00:00

Affected: Go: github.com/go-git/go-git/v5

### Impact

`go-git`’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing.

This issue only affects Git index format version 4. Earlier formats (`go-git` supports only `v2` and `v3`) are not vulnerable to this issue.

An attacker able to supply a crafted `.git/index` file can cause applications using go-git to panic while reading the index. If the application does not recover from panics, this results in process termination, leading to a denial-of-service (DoS) condition.

Exploitation requires the ability to modify or inject a Git index file within the local repository in disk. This typically implies write access to the `.git` directory.

### Patches

Users should upgrade to `v5.17.1`, or the latest `v6` [pseudo-version](https://go.dev/ref/mod#pseudo-versions), in order to mitigate this vulnerability.

### Credit

go-git maintainers thank @kq5y for finding and reporting this issue privately to the `go-git` project.

 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-33762 UBUNTU-CVE-2026-33762 2026-10-01T12:51:27.419335+00:00

Affected: Ubuntu:Pro:22.04:LTS: golang-github-go-git-go-git, Ubuntu:Pro:24.04:LTS: golang-github-go-git-go-git, Ubuntu:25.10: golang-github-go-git-go-git, Ubuntu:Pro:26.04:LTS: golang-github-go-git-go-git

go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing. This issue only affects Git index format version 4. Earlier formats (go-git supports only v2 and v3) are not vulnerable to this issue. This issue has been patched in version 5.17.1.