[CVE-2026-71557 ] Published: Aug 7, 2026, 4:41:31 PM UTC
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the refer
Medium(6.3) Affected Details (4) 5.4.2-3 · all · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
5.4.2-3 · all · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
5.4.2-3+b7 · amd64 · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
5.4.2-3+b7 · arm64 · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
[CVE-2026-71556 ] Published: Aug 7, 2026, 4:37:40 PM UTC
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the wo
High(7.1) Affected Details (4) 5.4.2-3 · all · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
5.4.2-3 · all · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
5.4.2-3+b7 · amd64 · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
5.4.2-3+b7 · arm64 · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
[CVE-2026-45570 ] Published: May 21, 2026, 12:00:00 AM UTC
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in s
Critical(9.6) Affected Details (4) 5.4.2-3 · all · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
5.4.2-3 · all · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
5.4.2-3+b7 · amd64 · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
5.4.2-3+b7 · arm64 · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
[CVE-2026-45571 ] Published: May 21, 2026, 12:00:00 AM UTC
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could allow crafted repository data to affect files outside
Medium(5.4) Affected Details (4) 5.4.2-3 · all · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
5.4.2-3 · all · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
5.4.2-3+b7 · amd64 · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
5.4.2-3+b7 · arm64 · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
[CVE-2026-45022 ] Published: May 13, 2026, 12:00:00 AM UTC
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or
High(7.5) Affected Details (4) 5.4.2-3 · all · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
5.4.2-3 · all · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
5.4.2-3+b7 · amd64 · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
5.4.2-3+b7 · arm64 · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
[CVE-2026-41506 ] Published: May 8, 2026, 1:43:19 PM UTC
go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart
Medium(6.5) Affected Details (4) 5.4.2-3 · all · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
5.4.2-3 · all · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
5.4.2-3+b7 · amd64 · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
5.4.2-3+b7 · arm64 · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
[CVE-2026-33762 ] Published: Mar 31, 2026, 1:47:42 PM UTC
go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applyin
Low(2.8) Affected Details (4) 5.4.2-3 · all · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
5.4.2-3 · all · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
5.4.2-3+b7 · amd64 · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
5.4.2-3+b7 · arm64 · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
[CVE-2026-34165 ] Published: Mar 31, 2026, 1:46:37 PM UTC
go-git is an extensible git implementation library written in pure Go. From version 5.0.0 to before version 5.17.1, a vulnerability has been identified in which a maliciously crafted .idx file can cau
Medium(5) Affected Details (4) 5.4.2-3 · all · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
5.4.2-3 · all · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
5.4.2-3+b7 · amd64 · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
5.4.2-3+b7 · arm64 · bookworm
Affected
nvd · golang-github-go-git-go-git · debian · bookworm; nvd · golang-github-go-git-go-git · debian · 12
[CVE-2026-25934 ] Published: Feb 9, 2026, 10:13:41 PM UTC
go-git vulnerabilities
Medium(4.3) Affected Details (4) 5.4.2-3 · all · bookworm
Affected
usn · golang-github-go-git-go-git · debian · bookworm; usn · golang-github-go-git-go-git · debian · 12
5.4.2-3 · all · bookworm
Affected
usn · golang-github-go-git-go-git · debian · bookworm; usn · golang-github-go-git-go-git · debian · 12
5.4.2-3+b7 · amd64 · bookworm
Affected
usn · golang-github-go-git-go-git · debian · bookworm; usn · golang-github-go-git-go-git · debian · 12
5.4.2-3+b7 · arm64 · bookworm
Affected
usn · golang-github-go-git-go-git · debian · bookworm; usn · golang-github-go-git-go-git · debian · 12
[CVE-2025-21614 ] Published: Jan 6, 2025, 4:20:16 PM UTC
go-git vulnerabilities
High(7.5) Affected Details (4) 5.4.2-3 · all · bookworm
Affected
usn · golang-github-go-git-go-git · debian · bookworm; usn · golang-github-go-git-go-git · debian · 12
5.4.2-3 · all · bookworm
Affected
usn · golang-github-go-git-go-git · debian · bookworm; usn · golang-github-go-git-go-git · debian · 12
5.4.2-3+b7 · amd64 · bookworm
Affected
usn · golang-github-go-git-go-git · debian · bookworm; usn · golang-github-go-git-go-git · debian · 12
5.4.2-3+b7 · arm64 · bookworm
Affected
usn · golang-github-go-git-go-git · debian · bookworm; usn · golang-github-go-git-go-git · debian · 12
[CVE-2025-21613 ] Published: Jan 6, 2025, 4:13:10 PM UTC
go-git vulnerabilities
High(8.1) Affected Details (4) 5.4.2-3 · all · bookworm
Affected
usn · golang-github-go-git-go-git · debian · bookworm; usn · golang-github-go-git-go-git · debian · 12
5.4.2-3 · all · bookworm
Affected
usn · golang-github-go-git-go-git · debian · bookworm; usn · golang-github-go-git-go-git · debian · 12
5.4.2-3+b7 · amd64 · bookworm
Affected
usn · golang-github-go-git-go-git · debian · bookworm; usn · golang-github-go-git-go-git · debian · 12
5.4.2-3+b7 · arm64 · bookworm
Affected
usn · golang-github-go-git-go-git · debian · bookworm; usn · golang-github-go-git-go-git · debian · 12
