{"id":"CVE-2026-33762","kind":"vulnerability","aliases":["CVE-2026-33762","GHSA-gm2x-2g9h-ccm8"],"related":[],"title":"go-git missing validation decoding Index v4 files leads to panic","description":"### Impact\n\n`go-git`’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing.\n\nThis issue only affects Git index format version 4. Earlier formats (`go-git` supports only `v2` and `v3`) are not vulnerable to this issue.\n\nAn attacker able to supply a crafted `.git/index` file can cause applications using go-git to panic while reading the index. If the application does not recover from panics, this results in process termination, leading to a denial-of-service (DoS) condition.\n\nExploitation requires the ability to modify or inject a Git index file within the local repository in disk. This typically implies write access to the `.git` directory.\n\n### Patches\n\nUsers should upgrade to `v5.17.1`, or the latest `v6` [pseudo-version](https://go.dev/ref/mod#pseudo-versions), in order to mitigate this vulnerability.\n\n### Credit\n\ngo-git maintainers thank @kq5y for finding and reporting this issue privately to the `go-git` project.","summary":"A crafted Git index file in format version 4 makes go-git panic during index parsing, because a path prefix length is not validated before slicing. An attacker who can write a malicious .git/index can crash any Go application that reads that index without recovering from panics.","severity":"low","cvss":2.8,"epss":0.00159,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/go-git/go-git/v5","fixed":["5.17.1"],"affected":"<= 5.17.0","ecosystem":"go"},{"name":"go-git project go-git","fixed":["5.17.1"],"affected":"< 5.17.1","ecosystem":"vendor"}],"ecosystems":["go","vendor"],"tags":["cwe-129","go","go-git","package","self-hosted"],"not_affected_if":["index-format-v2-or-v3","panics-recovered","trusted-repositories-only"],"how_to_check":"- Look for `github.com/go-git/go-git/v5` in `go.mod` and check the pinned version.\n- Check whether the application reads repository index files with format version 4 (the `.git/index` of the repo it opens).\n- `go list -m github.com/go-git/go-git/v5`","fix":"- `github.com/go-git/go-git/v5` `5.17.1` or later, or the latest `v6` pseudo-version","status":"open","published_at":"2026-03-30T17:05:23+00:00","first_seen_at":"2026-11-02T23:04:40+00:00","triaged_at":"2026-11-02T23:04:50+00:00","updated_at":"2026-11-02T23:06:16+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-02T23:04:50Z","model":"claude-haiku-5-5","output":{"fix":"- `github.com/go-git/go-git/v5` `5.17.1` or later, or the latest `v6` pseudo-version","reach":"local","title":"go-git: crafted Index v4 file causes a panic and process crash","impact":"low","summary":"A crafted Git index file in format version 4 makes go-git panic during index parsing, because a path prefix length is not validated before slicing. An attacker who can write a malicious .git/index can crash any Go application that reads that index without recovering from panics.","audience":"developers","category":"package","nicknames":[],"who_cares":["go","go-git","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Application process crashes during index parsing, causing denial of service","analyst_note":"","how_to_check":"- Look for `github.com/go-git/go-git/v5` in `go.mod` and check the pinned version.\n- Check whether the application reads repository index files with format version 4 (the `.git/index` of the repo it opens).\n- `go list -m github.com/go-git/go-git/v5`","plain_action":"","needs_analyst":false,"not_affected_if":["index-format-v2-or-v3","trusted-repositories-only","panics-recovered"],"who_is_affected":"Only Go applications that use go-git to read a repository's .git/index file, and only index format version 4 triggers the panic. An attacker needs write access to the .git directory of a repository the application opens, so applications that only handle trusted repositories or recover from panics are less exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000731,"input_tokens":4523,"output_tokens":557,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-129':35B '-2026':14A,22A '-33762':15A,23A '/go-git/go-git/v5':26A '/ref/mod#pseudo-versions),':254C '2g9h':19A '4':52B,102C,151C 'abil':215C 'abl':170C 'access':234C 'affect':146C 'appli':112C 'applic':83B,179C,192C 'attack':72B,169C 'bound':131C 'caus':178C 'ccm8':20A 'condit':211C 'craft':45B,122C,174C 'crash':80B 'credit':261C 'cve':13A,21A 'cwe':34B 'decod':6A,98C,117C 'denial':207C 'denial-of-servic':206C 'directori':238C 'disk':229C 'dos':210C 'earlier':152C 'exploit':212C 'fail':103C 'file':9A,48B,124C,176C,223C 'find':269C 'format':50B,100C,149C,153C 'ghsa':17A 'ghsa-gm2x-2g9h-ccm8':16A 'git':3A,29A,33A,39B,46B,56B,95C,147C,156C,183C,221C,237C,264C,279C 'git/index':78B,175C 'github.com':25A 'github.com/go-git/go-git/v5':24A 'gm2x':18A 'go':2A,28A,32A,36B,38B,55B,82B,94C,155C,182C,263C,278C 'go-git':1A,27A,31A,37B,54B,93C,154C,181C,262C,277C 'go.dev':253C 'go.dev/ref/mod#pseudo-versions),':252C 'host':43B 'impact':92C 'impli':232C 'index':7A,47B,59B,87B,97C,123C,141C,148C,189C,222C 'inject':219C 'issu':144C,167C,273C 'kq5y':267C 'latest':247C 'lead':10A,203C 'length':65B,110C 'local':226C 'maintain':265C 'make':53B 'malici':77B,121C 'miss':4A 'mitig':258C 'modifi':217C 'name':108C,119C 'normal':140C 'oper':133C 'order':256C 'out-of-bound':128C 'packag':40B 'panic':12A,57B,91B,138C,185C,197C 'pars':60B,142C 'patch':239C 'path':63B,107C,118C 'prefix':64B,109C 'previous':116C 'privat':274C 'process':201C 'project':30A,280C 'pseudo':250C 'pseudo-vers':249C 'read':85B,187C 'recov':89B,195C 'report':271C 'repositori':227C 'requir':213C 'result':134C,199C 'runtim':137C 'self':42B 'self-host':41B 'servic':209C 'slice':70B,132C 'suppli':172C 'support':157C 'termin':202C 'thank':266C 'trigger':126C 'typic':231C 'upgrad':242C 'use':180C 'user':240C 'v2':159C 'v3':161C 'v4':8A 'v5.17.1':244C 'v6':248C 'valid':5A,68B,105C 'version':51B,101C,150C,251C 'vulner':164C,260C 'within':224C 'without':88B 'write':75B,233C","nicknames":[],"mitigations":[],"who_affected":"Only Go applications that use go-git to read a repository's .git/index file, and only index format version 4 triggers the panic. An attacker needs write access to the .git directory of a repository the application opens, so applications that only handle trusted repositories or recover from panics are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["githubcomgogitgogitv5","gogitprojectgogit","projectgogit"],"ptokens":["com","git","github","go","project","v5"],"labels":["cwe129","go","gogit","low","package","selfhosted","vendor"],"first_public_at":"2026-03-29T20:13:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-gm2x-2g9h-ccm8","url":"https://github.com/advisories/GHSA-gm2x-2g9h-ccm8","severity":"low","published_at":"2026-03-30T17:05:23+00:00","modified_at":"2026-11-02T22:59:38+00:00","first_seen_at":"2026-11-02T23:04:40+00:00","fetched_at":"2026-11-02T23:04:40+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-33762","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33762","severity":null,"published_at":"2026-03-31T15:16:15+00:00","modified_at":"2026-07-24T21:10:00+00:00","first_seen_at":"2026-11-02T23:06:16+00:00","fetched_at":"2026-11-02T23:06:16+00:00","note":null}],"documents":[{"id":54302,"url":"https://api.github.com/repos/go-git/go-git/security-advisories/GHSA-gm2x-2g9h-ccm8","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":54303,"url":"https://github.com/go-git/go-git/security/advisories/GHSA-gm2x-2g9h-ccm8","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-03-29T20:13:26+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":54304,"url":"https://github.com/go-git/go-git/releases/tag/v5.17.1","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":54305,"url":"https://github.com/go-git/go-git/commit/e9b65df44cb97faeba148b47523a362beaecddf9","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}