go-git clients vulnerable to DoS via maliciously crafted Git server replies
Priority MEDIUM 40CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 15 fixed, 45 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00717 54th percentileScored 2026-11-07
Fix Partial go-git (go-git): 5.13.0github.com/go-git/go-git/v5 (Go): 5.13.0Red Hat: 17 advisoriesRed Hat: 15 fixed, 45 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| go-git | go-git | 4.0.0 to before 5.13.0 | 5.13.0 | Patch available | CNA |
| — | gopkg.in/src-d/go-git.v4 (Go) | 4.0.0 – 4.13.1 | — | No fix listed | GHSA-r9px-m959-cxf4 |
| — | github.com/go-git/go-git/v5 (Go) | before 5.13.0 | 5.13.0 | Patch available | GHSA-r9px-m959-cxf4 |
| — | github.com/go-git/go-git (Go) | 4.0.0 – 4.13.1 | — | No fix listed | GHSA-r9px-m959-cxf4 |
- go-git Vendorgo-git Affected 4.0.0 to before 5.13.0 Fixed in 5.13.0 Patch available CNA
- gopkg.in/src-d/go-git.v4 (Go) Vendor— Affected 4.0.0 – 4.13.1 Fixed in — No fix listed GHSA-r9px-m959-cxf4
- github.com/go-git/go-git/v5 (Go) Vendor— Affected before 5.13.0 Fixed in 5.13.0 Patch available GHSA-r9px-m959-cxf4
- github.com/go-git/go-git (Go) Vendor— Affected 4.0.0 – 4.13.1 Fixed in — No fix listed GHSA-r9px-m959-cxf4
Remediation
- Fix · CNA go-git (go-git) Fixed in 5.13.0
- Fix · GHSA-r9px-m959-cxf4 github.com/go-git/go-git/v5 (Go) Fixed in 5.13.0 Advisory →
Red Hat 17 advisories
- RHSA-2026:37387 Released 2026-07-09 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +24
- RHSA-2025:3069 Released 2025-03-20 · Red Hat rating ImportantErrata Advisory for Red Hat OpenShift GitOps v1.14.3 security update
- Red Hat OpenShift GitOps 1.14 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 +7
- RHSA-2025:1704 Released 2025-02-27 · Red Hat rating ImportantOpenShift Container Platform 4.16.36 security and extras update
- Red Hat OpenShift Container Platform 4.16 openshift4/ose-helm-rhel9-operator, openshift4/ose-operator-sdk-rhel9
Show 14 more Red Hat advisories
- RHSA-2025:1888 Released 2025-02-26 · Red Hat rating ImportantErrata Advisory for Red Hat OpenShift GitOps v1.15.1 security update
- Red Hat OpenShift GitOps 1.15 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-extensions-rhel8, openshift-gitops-1/argocd-rhel8 +7
- RHSA-2025:1870 Released 2025-02-26 · Red Hat rating ImportantRed Hat OpenStack Platform 17.1 (osp-director-operator) security update
- Red Hat OpenStack Platform 17.1 rhosp-rhel9/osp-director-agent, rhosp-rhel9/osp-director-downloader, rhosp-rhel9/osp-director-operator +1
- RHSA-2025:1869 Released 2025-02-26 · Red Hat rating ImportantRed Hat OpenStack Platform 16.2 (osp-director-operator) security update
- Red Hat OpenStack Platform 16.2 rhosp-rhel8/osp-director-agent, rhosp-rhel8/osp-director-downloader, rhosp-rhel8/osp-director-operator +1
- RHSA-2024:6122 Released 2025-02-25 · Red Hat rating ImportantOpenShift Container Platform 4.18.1 bug fix and security update
- Red Hat OpenShift Container Platform 4.18 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/azure-service-rhel9-operator +47
- RHSA-2024:6121 Released 2025-02-25 · Red Hat rating ImportantOpenShift Container Platform 4.18.1 security and extras update
- Red Hat OpenShift Container Platform 4.18 openshift4/ingress-node-firewall-rhel9, openshift4/ingress-node-firewall-rhel9-operator, openshift4/kube-compare-artifacts-rhel9 +47
- RHSA-2025:1468 Released 2025-02-13 · Red Hat rating ImportantACS 4.4 enhancement and security update
- RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-rhel8-operator +1
- RHSA-2025:1334 Released 2025-02-11 · Red Hat rating ImportantACS 4.5 enhancement and security update
- RHACS 4.5 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-rhel8-operator +5
- RHSA-2025:1119 Released 2025-02-11 · Red Hat rating ImportantOpenShift Container Platform 4.17.16 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 openshift4/ose-helm-rhel9-operator, openshift4/ose-operator-sdk-rhel9, openshift4/ose-sriov-network-config-daemon-rhel9
- RHSA-2025:0907 Released 2025-02-03 · Red Hat rating CriticalACS 4.6.2 enhancement and security update
- RHACS 4.6 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +10
- RHSA-2025:0654 Released 2025-01-28 · Red Hat rating ImportantOpenShift Container Platform 4.17.14 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 openshift4/oc-mirror-plugin-rhel9, openshift4/ose-agent-installer-api-server-rhel9, openshift4/ose-baremetal-cluster-api-controllers-rhel9 +6
- RHSA-2025:0662 Released 2025-01-23 · Red Hat rating Importantgrafana security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) grafana-9.2.10-21.el9_4, grafana-selinux-9.2.10-21.el9_4
- RHSA-2025:0445 Released 2025-01-20 · Red Hat rating ImportantRed Hat Trusted Profile Analyzer 1.2.2
- Red Hat Trusted Profile Analyzer 1.2 registry.redhat.io/rhtpa/rhtpa-trustification-service-rhel9
- RHSA-2025:0444 Released 2025-01-20 · Red Hat rating ImportantRed Hat Trusted Profile Analyzer 1.2.2
- Red Hat Trusted Profile Analyzer 1.2 registry.redhat.io/rhtpa/rhtpa-guac-rhel9
- RHSA-2025:0401 Released 2025-01-20 · Red Hat rating Importantgrafana security update
- Red Hat Enterprise Linux AppStream (v. 8) grafana-9.2.10-21.el8_10, grafana-selinux-9.2.10-21.el8_10
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Affected | — |
| Builds for Red Hat OpenShift | Affected | — |
| Compliance Operator | Affected | — |
| Confidential Compute Attestation | Affected | — |
| Custom Metric Autoscaler operator for Red Hat Openshift | Affected | — |
| External Secrets Operator for Red Hat OpenShift | Affected | — |
| File Integrity Operator | Affected | — |
| Kernel Module Management Operator for Red Hat Openshift | Affected | — |
| Logging Subsystem for Red Hat OpenShift | Affected | — |
| Logical Volume Manager Storage | Affected | — |
| Machine Deletion Remediation Operator | Affected | — |
| Migration Toolkit for Containers | Affected | — |
| Migration Toolkit for Virtualization | Affected | — |
| Multicluster Engine for Kubernetes | Affected | — |
| Network Observability Operator | Affected | — |
| Node HealthCheck Operator | Affected | — |
| OpenShift API for Data Protection | Affected | No fix planned: Will not fix |
| OpenShift Developer Tools and Services | Affected | No fix planned: Will not fix |
| OpenShift Lightspeed | Affected | — |
| OpenShift Pipelines | Affected | — |
| OpenShift Serverless | Affected | No fix yet |
| OpenShift Service Mesh 3 | Affected | — |
| Power monitoring for Red Hat OpenShift | Affected | — |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 4 | Affected | — |
| Red Hat Ansible Automation Platform 2 | Affected | — |
| Red Hat Build of Kueue | Affected | — |
| Red Hat Ceph Storage 7 | Affected | No fix yet |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | — |
| Red Hat Edge Manager preview | Affected | — |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) | Affected | — |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | — |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Dev Spaces | Affected | — |
| Red Hat OpenShift Dev Workspaces Operator | Affected | — |
| Red Hat OpenShift GitOps | Affected | — |
| Red Hat OpenShift Virtualization 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift for Windows Containers | Affected | — |
| Red Hat OpenStack Platform 16.2 | Affected | — |
| Red Hat OpenStack Platform 17.1 | Affected | — |
| Red Hat OpenStack Platform 18.0 | Affected | — |
| Red Hat Trusted Artifact Signer | Affected | — |
| Red Hat Web Terminal | Affected | — |
| CNV 4.18 for RHEL 9 | Fixed | — |
| RHACS 4.4 for RHEL 8 | Fixed | RHSA-2025:1468 |
| RHACS 4.5 for RHEL 8 | Fixed | RHSA-2025:1334 |
| RHACS 4.6 for RHEL 8 | Fixed | RHSA-2025:0907 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2025:0401 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2025:0662 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2025:1704 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2025:0654, RHSA-2025:1119 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2024:6121, RHSA-2024:6122 |
| Red Hat OpenShift GitOps 1.14 | Fixed | RHSA-2025:3069 |
| Red Hat OpenShift GitOps 1.15 | Fixed | RHSA-2025:1888 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2025:1869 |
| Red Hat OpenStack Platform 17.1 | Fixed | RHSA-2025:1870 |
| Red Hat Openshift Data Foundation 4.22 | Fixed | RHSA-2026:37387 |
| Red Hat Trusted Profile Analyzer 1.2 | Fixed | RHSA-2025:0444, RHSA-2025:0445 |
Not affected: 9 products
- RHACS 4.4 for RHEL 8
- RHACS 4.5 for RHEL 8
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Container Platform 4.18
- Red Hat OpenShift Dev Spaces
- Red Hat OpenStack Platform 16.2
- Red Hat Openshift Data Foundation 4.22
Timeline
- 2026-10-02 Threatist record created from CVE-2025-21614
- 2026-10-03 Alias added: GHSA-r9px-m959-cxf4
- 2026-10-08 Affected versions changed · Red Hat
- 2026-10-13 Affected versions changed · Red Hat
- 2026-10-23 Affected versions changed · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-30 Fix available: CNV 4.18 for RHEL 9 · Red Hat
References
More Go-git vulnerabilities
- TI-2023-27070 Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients CVSS 3.1CRITICAL 9.8
- TI-2025-15573 go-git has an Argument Injection via the URL field CVSS 4.0CRITICAL 9.2
- TI-2023-27069 Maliciously crafted Git server replies can cause DoS on go-git clients CVSS 3.1HIGH 7.5
- TI-2026-30091 go-git Credential leak via cross-host redirect in smart HTTP transport CVSS 3.1HIGH 7.4
- TI-2026-32877 go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git CVSS 4.0HIGH 7.0
- TI-2026-33320 go-git: Crafted repositories may modify main and submodule .git directories CVSS 3.1MEDIUM 5.4
Sources
- CVE-2025-21614 · CVE Program
- CVE-2025-21614 · NVD
- FIRST EPSS
- GHSA-r9px-m959-cxf4 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-21614 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences