CVE catalog

CVE-2026-33762

go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applyin

[CVE catalog]

Severity
Low · CVSS 2.8CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.15% · Oct 25, 2026

go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing. This issue only affects Git index format version 4. Earlier formats (go-git supports only v2 and v3) are not vulnerable to this issue. This issue has been patched in version 5.17.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-go-git-go-gitsid5.19.2-2fixed
Debiangolang-github-go-git-go-gitforky5.19.2-2fixed
Debiangolang-github-go-git-go-gittrixie5.14.0-1vulnerable
Debiangolang-github-go-git-go-gitbookworm5.4.2-3vulnerable
Cpegolang-github-go-git-go-gitNot reportedNot reportedvulnerable
Cpego-gitNot reported5.17.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-go-git-go-gitsourcesid5.17.1-1not yet assignedNot reported[1132584]
Debiangolang-github-go-git-go-gitsourceforky5.17.1-1not yet assignedNot reported[1132584]
Debiangolang-github-go-git-go-gitsourcetrixie(unfixed)not yet assignedNot reported[1132584]
Debiangolang-github-go-git-go-gitsourcebookworm(unfixed)not yet assignedNot reported[1132584]
Cpego-gitcpeNot reported5.17.1Not reportedNot reportedNot reported

[Debian bug #1132584]

Notes

[trixie] golang-github-go-git-go-git: Minor issue [bookworm] golang-github-go-git-go-git: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [go-git]Affected

    Source package: [golang-github-go-git-go-git]

    Details (2)

    • 5.4.2-3+b7 · amd64 · bookworm

      Affected

      nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12

    • 5.4.2-3+b7 · arm64 · bookworm

      Affected

      nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12

  • [golang-github-go-git-go-git-dev]Affected

    Source package: [golang-github-go-git-go-git]

    Details (2)

    • 5.4.2-3 · all · bookworm

      Affected

      nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12

    • 5.4.2-3 · all · bookworm

      Affected

      nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12

[Debian 13 (Trixie)]

  • [go-git]Affected

    Source package: [golang-github-go-git-go-git]

    Details (2)

    • 5.14.0-1+b3 · amd64 · trixie

      Affected

      nvd · golang-github-go-git-go-git · debian · 13

    • 5.14.0-1+b3 · arm64 · trixie

      Affected

      nvd · golang-github-go-git-go-git · debian · 13

  • [golang-github-go-git-go-git-dev]Affected

    Source package: [golang-github-go-git-go-git]

    Details (2)

    • 5.14.0-1 · all · trixie

      Affected

      nvd · golang-github-go-git-go-git · debian · 13

    • 5.14.0-1 · all · trixie

      Affected

      nvd · golang-github-go-git-go-git · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]