---
id: "CVE-2026-33762"
kind: "vulnerability"
aliases: ["CVE-2026-33762", "GHSA-gm2x-2g9h-ccm8"]
title: "go-git missing validation decoding Index v4 files leads to panic"
severity: "low"
cvss: 2.8
epss: 0.00159
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/go-git/go-git/v5", "fixed": ["5.17.1"], "affected": "<= 5.17.0", "ecosystem": "go"}, {"name": "go-git project go-git", "fixed": ["5.17.1"], "affected": "< 5.17.1", "ecosystem": "vendor"}]
ecosystems: ["go", "vendor"]
tags: ["cwe-129", "go", "go-git", "package", "self-hosted"]
not_affected_if: ["index-format-v2-or-v3", "panics-recovered", "trusted-repositories-only"]
published_at: "2026-03-30T17:05:23+00:00"
first_seen_at: "2026-11-02T23:04:40+00:00"
updated_at: "2026-11-02T23:06:16+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-gm2x-2g9h-ccm8", "first_seen_at": "2026-11-02T23:04:40+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33762", "first_seen_at": "2026-11-02T23:06:16+00:00"}]
---

# go-git missing validation decoding Index v4 files leads to panic

A crafted Git index file in format version 4 makes go-git panic during index parsing, because a path prefix length is not validated before slicing. An attacker who can write a malicious .git/index can crash any Go application that reads that index without recovering from panics.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/go-git/go-git/v5 affected <= 5.17.0 fixed 5.17.1
- vendor:go-git project go-git affected < 5.17.1 fixed 5.17.1

## How to check

- Look for `github.com/go-git/go-git/v5` in `go.mod` and check the pinned version.
- Check whether the application reads repository index files with format version 4 (the `.git/index` of the repo it opens).
- `go list -m github.com/go-git/go-git/v5`

## Fix

- `github.com/go-git/go-git/v5` `5.17.1` or later, or the latest `v6` pseudo-version

## Timeline

- 2026-11-02T23:04:40+00:00 ghsa https://github.com/advisories/GHSA-gm2x-2g9h-ccm8
- 2026-11-02T23:06:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-33762

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/go-git/go-git/security-advisories/GHSA-gm2x-2g9h-ccm8
- [advisory] Maintainer's advisory: github.com https://github.com/go-git/go-git/security/advisories/GHSA-gm2x-2g9h-ccm8
- [fix] Release: github.com https://github.com/go-git/go-git/releases/tag/v5.17.1
- [fix] Patch: github.com https://github.com/go-git/go-git/commit/e9b65df44cb97faeba148b47523a362beaecddf9

## From the sources

### Impact

`go-git`’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing.

This issue only affects Git index format version 4. Earlier formats (`go-git` supports only `v2` and `v3`) are not vulnerable to this issue.

An attacker able to supply a crafted `.git/index` file can cause applications using go-git to panic while reading the index. If the application does not recover from panics, this results in process termination, leading to a denial-of-service (DoS) condition.

Exploitation requires the ability to modify or inject a Git index file within the local repository in disk. This typically implies write access to the `.git` directory.

### Patches

Users should upgrade to `v5.17.1`, or the latest `v6` [pseudo-version](https://go.dev/ref/mod#pseudo-versions), in order to mitigate this vulnerability.

### Credit

go-git maintainers thank @kq5y for finding and reporting this issue privately to the `go-git` project.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_