https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 21:16:07 +0000 https://vulnerability.circl.lu/vuln/ghsa-w5pp-99ch-qj29 <p><strong>Affected:</strong> Go: github.com/go-git/go-git/v5, Go: github.com/go-git/go-git/v6</p> <p>### Impact Several denial-of-service issues were identified in `go-git` when parsing maliciously crafted Git repository data.</p> <p>An attacker may craft a malicious `.pack`, `.idx` or loose objects that causes an application using an affected version of `go-git` to panic or consume excessive resources.</p> <p>This can lead to denial of service in applications that use `go-git` to clone, fetch, open, or otherwise process untrusted repositories or Git object data.</p> <p>Exploitation requires the ability to alter read-only files such as `.pack` or `.idx` from the local repository&#39;s `.git/objects/pack/` directory. Alternatively, the user would need to be interacting with a malicious remote server, which is not recommended and exposes users to a broader class of security risks beyond this issue.</p> <p>### Patches Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to `v5` are likely to be affected, users are recommended to upgrade to a supported `go-git` version.</p> <p>### Credits go-git thanks @kodareef5, @AyushParkara and @N0zoM1z0 for reporting this in four separate reports. 🙇</p> <p><strong>Affected:</strong> Go: github.com/go-git/go-git/v5, Go: github.com/go-git/go-git/v6</p> <p>### Impact Several denial-of-service issues were identified in `go-git` when parsing maliciously crafted Git repository data.</p> <p>An attacker may craft a malicious `.pack`, `.idx` or loose objects that causes an application using an affected version of `go-git` to panic or consume excessive resources.</p> <p>This can lead to denial of service in applications that use `go-git` to clone, fetch, open, or otherwise process untrusted repositories or Git object data.</p> <p>Exploitation requires the ability to alter read-only files such as `.pack` or `.idx` from the local repository&#39;s `.git/objects/pack/` directory. Alternatively, the user would need to be interacting with a malicious remote server, which is not recommended and exposes users to a broader class of security risks beyond this issue.</p> <p>### Patches Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to `v5` are likely to be affected, users are recommended to upgrade to a supported `go-git` version.</p> <p>### Credits go-git thanks @kodareef5, @AyushParkara and @N0zoM1z0 for reporting this in four separate reports. 🙇</p> https://vulnerability.circl.lu/vuln/ghsa-w5pp-99ch-qj29