Live › vulnerability › CVE-2026-33762
A crafted Git index file in format version 4 makes go-git panic during index parsing, because a path prefix length is not validated before slicing. An attacker who can write a malicious .git/index can crash any Go application that reads that index without recovering from panics.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 23:04 UTC, 0h before NVD. All times on this page are UTC.
Only Go applications that use go-git to read a repository's .git/index file, and only index format version 4 triggers the panic. An attacker needs write access to the .git directory of a repository the application opens, so applications that only handle trusted repositories or recover from panics are less exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/go-git/go-git/v5 | go | <= 5.17.0 | 5.17.1 |
| go-git project go-git | vendor | < 5.17.1 | 5.17.1 |
github.com/go-git/go-git/v5 in go.mod and check the pinned version..git/index of the repo it opens).go list -m github.com/go-git/go-git/v5github.com/go-git/go-git/v5 5.17.1 or later, or the latest v6 pseudo-versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing.
This issue only affects Git index format version 4. Earlier formats (go-git supports only v2 and v3) are not vulnerable to this issue.
An attacker able to supply a crafted .git/index file can cause applications using go-git to panic while reading the index. If the application does not recover from panics, this results in process termination, leading to a denial-of-service (DoS) condition.
Exploitation requires the ability to modify or inject a Git index file within the local repository in disk. This typically implies write access to the .git directory.
Users should upgrade to v5.17.1, or the latest v6 pseudo-version, in order to mitigate this vulnerability.
go-git maintainers thank @kq5y for finding and reporting this issue privately to the go-git project.
This page as .md · .json · in your agent: get_signal("CVE-2026-33762")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.