Read the docs
TI-2023-27069 Aliases CVE-2023-49568GHSA-mw99-9chc-xw7r

Maliciously crafted Git server replies can cause DoS on go-git clients

Priority LOW 34CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 13 fixed, 7 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Applications using only the in-memory filesystem supported by go-git are not affected by this vulnerability. This is a go-git implementation issue and does not affect the upstream git cli.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00698 53rd percentileScored 2026-11-07
Fix Partial github.com/go-git/go-git/v5 (Go): 5.11.0Red Hat: 24 advisoriesRed Hat: 13 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
go-gitgo-git5.11.0—No fix listedCNA
—github.com/go-git/go-git/v5 (Go)before 5.11.05.11.0Patch availableGHSA-mw99-9chc-xw7r
—gopkg.in/src-d/go-git.v4 (Go)4.7.1 – 4.13.1—No fix listedGHSA-mw99-9chc-xw7r
  • go-git Vendorgo-git Affected 5.11.0 Fixed in — No fix listed CNA
  • github.com/go-git/go-git/v5 (Go) Vendor— Affected before 5.11.0 Fixed in 5.11.0 Patch available GHSA-mw99-9chc-xw7r
  • gopkg.in/src-d/go-git.v4 (Go) Vendor— Affected 4.7.1 – 4.13.1 Fixed in — No fix listed GHSA-mw99-9chc-xw7r

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:go-git_project:go-git:*:*:*:*:*:go:*:*4.0.0 to before 5.11.0Vulnerablego-git
  • cpe:2.3:a:go-git_project:go-git:*:*:*:*:*:go:*:* Versions 4.0.0 to before 5.11.0 Vulnerable ·go-git

Remediation

  • Fix · GHSA-mw99-9chc-xw7r github.com/go-git/go-git/v5 (Go) Fixed in 5.11.0 Advisory →

Red Hat 24 advisories

  • RHSA-2024:4010 Released 2024-06-26 · Red Hat rating Important
    OpenShift Container Platform 4.14.31 security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-aws-cloud-controller-manager-rhel8, openshift4/ose-olm-rukpak-rhel8, openshift4/ose-operator-lifecycle-manager +4
  • RHSA-2024:3889 Released 2024-06-18 · Red Hat rating Important
    OpenShift Container Platform 4.15.18 security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/ose-aws-cloud-controller-manager-rhel9, openshift4/ose-cluster-image-registry-rhel9-operator, openshift4/ose-operator-marketplace-rhel9 +1
  • RHSA-2024:3925 Released 2024-06-14 · Red Hat rating Critical
    Red Hat Ceph Storage 7.1 security, enhancements, and bug fix update
    • Red Hat Ceph Storage 7.1 Tools ceph-2:18.2.1-194.el8cp, ceph-2:18.2.1-194.el9cp, ceph-base-2:18.2.1-194.el8cp +47
Show 21 more Red Hat advisories
  • RHSA-2024:2047 Released 2024-05-02 · Red Hat rating Important
    OpenShift Container Platform 4.13.41 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/kubevirt-csi-driver-rhel8, openshift4/oc-mirror-plugin-rhel8, openshift4/ose-cluster-monitoring-operator +1
  • RHSA-2024:1891 Released 2024-04-26 · Red Hat rating Important
    OpenShift Container Platform 4.14.22 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel9, openshift4/egress-router-cni-rhel8 +47
  • RHSA-2024:1887 Released 2024-04-25 · Red Hat rating Important
    OpenShift Container Platform 4.15.10 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/oc-mirror-plugin-rhel9, openshift4/ose-cluster-monitoring-rhel9-operator, openshift4/ose-kubevirt-cloud-controller-manager-rhel9
  • RHSA-2024:1896 Released 2024-04-25 · Red Hat rating Important
    OpenShift Container Platform 4.12.56 security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2024:1570 Released 2024-03-28 · Red Hat rating Important
    ACS 4.4 enhancement and security update
    • RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +10
  • RHSA-2024:1557 Released 2024-03-28 · Red Hat rating Critical
    Errata Advisory for Red Hat OpenShift Builds 1.0.1
    • Builds for Red Hat OpenShift 1.0 openshift-builds/openshift-builds-controller-rhel8, openshift-builds/openshift-builds-git-cloner-rhel8, openshift-builds/openshift-builds-image-bundler-rhel8 +5
  • RHSA-2024:1052 Released 2024-03-06 · Red Hat rating Critical
    OpenShift Container Platform 4.12.51 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/ose-oauth-apiserver-rhel8, openshift4/ose-olm-rukpak-rhel8
  • RHSA-2024:0989 Released 2024-02-26 · Red Hat rating Critical
    Red Hat Multicluster GlobalHub 1.0.2 bug fixes and security updates
    • multicluster-globalhub 1.0 for RHEL 8 multicluster-globalhub/multicluster-globalhub-grafana-rhel8
  • RHSA-2024:0833 Released 2024-02-21 · Red Hat rating Critical
    OpenShift Container Platform 4.12.50 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/ose-alibaba-cloud-controller-manager-rhel8, openshift4/ose-cluster-authentication-operator, openshift4/ose-operator-lifecycle-manager +4
  • RHSA-2024:0845 Released 2024-02-21 · Red Hat rating Critical
    OpenShift Container Platform 4.13.34 security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/ose-operator-lifecycle-manager, openshift4/ose-operator-registry
  • RHSA-2024:0832 Released 2024-02-21 · Red Hat rating Critical
    OpenShift Container Platform 4.12.50 security and extras update
    • Red Hat OpenShift Container Platform 4.12 openshift4/ose-ansible-operator, openshift4/ose-helm-operator, openshift4/ose-operator-sdk-rhel8
  • RHSA-2024:0880 Released 2024-02-20 · Red Hat rating Critical
    Release of OpenShift Serverless Client kn 1.31.1 security update
    • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.10.0-6.el8
  • RHSA-2024:0843 Released 2024-02-15 · Red Hat rating Critical
    Release of OpenShift Serverless 1.31.1
    • Red Hat OpenShift Serverless 1.31 openshift-serverless-1-tech-preview/eventing-istio-controller-rhel8, openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1-tech-preview/logic-swf-builder-rhel8 +37
  • RHSA-2024:0741 Released 2024-02-14 · Red Hat rating Critical
    OpenShift Container Platform 4.13.33 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/egress-router-cni-rhel8, openshift4/ose-aws-cloud-controller-manager-rhel8, openshift4/ose-cluster-authentication-operator +3
  • RHSA-2024:0740 Released 2024-02-14 · Red Hat rating Critical
    OpenShift Container Platform 4.13.33 security and extras update
    • Red Hat OpenShift Container Platform 4.13 openshift4/ose-ansible-operator, openshift4/ose-helm-operator, openshift4/ose-operator-sdk-rhel8
  • RHSA-2024:0735 Released 2024-02-13 · Red Hat rating Critical
    OpenShift Container Platform 4.14.12 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-console, openshift4/ose-olm-rukpak-rhel8
  • RHSA-2024:0642 Released 2024-02-07 · Red Hat rating Critical
    OpenShift Container Platform 4.14.11 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-aws-cloud-controller-manager-rhel8, openshift4/ose-azure-cluster-api-controllers-rhel8, openshift4/ose-cluster-api-rhel8 +7
  • RHSA-2024:0641 Released 2024-02-07 · Red Hat rating Critical
    OpenShift Container Platform 4.14.11 security and extras update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-ansible-operator, openshift4/ose-helm-operator, openshift4/ose-kubernetes-nmstate-handler-rhel9 +1
  • RHSA-2024:0692 Released 2024-02-05 · Red Hat rating Critical
    Errata Advisory for Red Hat OpenShift GitOps 1.10.2 security update
    • Red Hat OpenShift GitOps 1.10 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/console-plugin-rhel8 +6
  • RHSA-2024:0691 Released 2024-02-05 · Red Hat rating Critical
    Errata Advisory for Red Hat OpenShift GitOps v1.9.4 security update
    • Red Hat OpenShift GitOps 1.9 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/console-plugin-rhel8 +6
  • RHSA-2024:0298 Released 2024-01-18 · Red Hat rating Critical
    Red Hat Advanced Cluster Management 2.9.2 security and bug fix container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8 rhacm2/multicluster-operators-subscription-rhel8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Advanced Cluster Security 3AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 6AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Data Science (RHODS)AffectedNo fix planned: Will not fix
Red Hat OpenShift Virtualization 4AffectedNo fix planned: Will not fix
Builds for Red Hat OpenShift 1.0Fixed RHSA-2024:1557
RHACS 4.4 for RHEL 8Fixed RHSA-2024:1570
Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8Fixed RHSA-2024:0298
Red Hat Ceph Storage 7.1 ToolsFixed RHSA-2024:3925
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2024:0832, RHSA-2024:0833, RHSA-2024:1052, RHSA-2024:1896
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2024:0740, RHSA-2024:0741, RHSA-2024:0845, RHSA-2024:2047
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2024:0641, RHSA-2024:0642, RHSA-2024:0735, RHSA-2024:1891, RHSA-2024:4010
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2024:1887, RHSA-2024:3889
Red Hat OpenShift GitOps 1.10Fixed RHSA-2024:0692
Red Hat OpenShift GitOps 1.9Fixed RHSA-2024:0691
Red Hat OpenShift Serverless 1.0Fixed RHSA-2024:0880
Red Hat OpenShift Serverless 1.31Fixed RHSA-2024:0843
multicluster-globalhub 1.0 for RHEL 8Fixed RHSA-2024:0989
Not affected: 15 products
  • RHACS 4.4 for RHEL 8
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • Red Hat Ceph Storage 7.1 Tools
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenStack Platform 16.2
  • Red Hat Openshift Data Foundation 4
  • multicluster-globalhub 1.0 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-49568
  2. 2026-10-03 Alias added: GHSA-mw99-9chc-xw7r

References

Advisory 2

Other 1

  • TI-2023-27070 Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients CVSS 3.1CRITICAL 9.8
  • TI-2025-15573 go-git has an Argument Injection via the URL field CVSS 4.0CRITICAL 9.2
  • TI-2025-15574 go-git clients vulnerable to DoS via maliciously crafted Git server replies CVSS 3.1HIGH 7.5
  • TI-2026-30091 go-git Credential leak via cross-host redirect in smart HTTP transport CVSS 3.1HIGH 7.4
  • TI-2026-32877 go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git CVSS 4.0HIGH 7.0
  • TI-2026-33320 go-git: Crafted repositories may modify main and submodule .git directories CVSS 3.1MEDIUM 5.4
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences