CVE catalog

CVE-2026-34165

go-git is an extensible git implementation library written in pure Go. From version 5.0.0 to before version 5.17.1, a vulnerability has been identified in which a maliciously crafted .idx file can cau

[CVE catalog]

Severity
Medium · CVSS 5CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.15% · Oct 25, 2026

go-git is an extensible git implementation library written in pure Go. From version 5.0.0 to before version 5.17.1, a vulnerability has been identified in which a maliciously crafted .idx file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a denial-of-service (DoS) condition. Exploitation requires write access to the local repository's .git directory, it order to create or alter existing .idx files. This issue has been patched in version 5.17.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-go-git-go-gitsid5.19.2-2fixed
Debiangolang-github-go-git-go-gitforky5.19.2-2fixed
Debiangolang-github-go-git-go-gittrixie5.14.0-1vulnerable
Debiangolang-github-go-git-go-gitbookworm5.4.2-3vulnerable
Cpegolang-github-go-git-go-gitNot reportedNot reportedvulnerable
Cpego-gitNot reported5.17.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-go-git-go-gitsourcesid5.17.1-1not yet assignedNot reported[1132584]
Debiangolang-github-go-git-go-gitsourceforky5.17.1-1not yet assignedNot reported[1132584]
Debiangolang-github-go-git-go-gitsourcetrixie(unfixed)not yet assignedNot reported[1132584]
Debiangolang-github-go-git-go-gitsourcebookworm(unfixed)not yet assignedNot reported[1132584]
Cpego-gitcpeNot reported5.17.1Not reportedNot reportedNot reported

[Debian bug #1132584]

Notes

[trixie] golang-github-go-git-go-git: Minor issue [bookworm] golang-github-go-git-go-git: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [go-git]Affected

    Source package: [golang-github-go-git-go-git]

    Details (2)

    • 5.4.2-3+b7 · amd64 · bookworm

      Affected

      nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12

    • 5.4.2-3+b7 · arm64 · bookworm

      Affected

      nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12

  • [golang-github-go-git-go-git-dev]Affected

    Source package: [golang-github-go-git-go-git]

    Details (2)

    • 5.4.2-3 · all · bookworm

      Affected

      nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12

    • 5.4.2-3 · all · bookworm

      Affected

      nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12

[Debian 13 (Trixie)]

  • [go-git]Affected

    Source package: [golang-github-go-git-go-git]

    Details (2)

    • 5.14.0-1+b3 · amd64 · trixie

      Affected

      nvd · golang-github-go-git-go-git · debian · 13

    • 5.14.0-1+b3 · arm64 · trixie

      Affected

      nvd · golang-github-go-git-go-git · debian · 13

  • [golang-github-go-git-go-git-dev]Affected

    Source package: [golang-github-go-git-go-git]

    Details (2)

    • 5.14.0-1 · all · trixie

      Affected

      nvd · golang-github-go-git-go-git · debian · 13

    • 5.14.0-1 · all · trixie

      Affected

      nvd · golang-github-go-git-go-git · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]