go-git improperly verifies data integrity values for .idx and .pack files
Priority LOW 19CWE-354Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 1 fixed, 37 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00156 4th percentileScored 2026-11-07
Fix Partial go-git (go-git): 5.16.5github.com/go-git/go-git/v5 (Go): 5.16.5Red Hat: 1 advisoryRed Hat: 1 fixed, 37 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| go-git | go-git | before 5.16.5 | 5.16.5 | Patch available | CNA |
| — | github.com/go-git/go-git/v5 (Go) | before 5.16.5 | 5.16.5 | Patch available | GHSA-37cx-329c-33x3 |
- go-git Vendorgo-git Affected before 5.16.5 Fixed in 5.16.5 Patch available CNA
- github.com/go-git/go-git/v5 (Go) Vendor— Affected before 5.16.5 Fixed in 5.16.5 Patch available GHSA-37cx-329c-33x3
Remediation
- Fix · CNA go-git (go-git) Fixed in 5.16.5
- Fix · GHSA-37cx-329c-33x3 github.com/go-git/go-git/v5 (Go) Fixed in 5.16.5 Advisory →
Red Hat 1 advisory
- RHSA-2026:37387 Released 2026-07-09 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +24
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Affected | No fix yet: Fix deferred |
| Builds for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Confidential Compute Attestation | Affected | No fix yet: Fix deferred |
| External Secrets Operator for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Kernel Module Management Operator for Red Hat Openshift | Affected | No fix yet: Fix deferred |
| Logging Subsystem for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Machine Deletion Remediation Operator | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Containers | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Virtualization | Affected | No fix yet: Fix deferred |
| Multicluster Engine for Kubernetes | Affected | No fix yet: Fix deferred |
| Network Observability Operator | Affected | No fix yet: Fix deferred |
| Node HealthCheck Operator | Affected | No fix yet: Fix deferred |
| OpenShift API for Data Protection | Affected | No fix yet: Fix deferred |
| OpenShift Developer Tools and Services | Affected | No fix yet: Fix deferred |
| OpenShift Pipelines | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 2 | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix yet: Fix deferred |
| Pen Drive Powered by Red Hat Lightspeed | Affected | No fix yet: Fix deferred |
| Power monitoring for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Build of Kueue | Affected | No fix yet: Fix deferred |
| Red Hat Edge Manager 1 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Workspaces Operator | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift GitOps | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift for Windows Containers | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 17.1 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | No fix yet: Fix deferred |
| Red Hat Openshift Data Foundation 4.22 | Fixed | RHSA-2026:37387 |
Not affected: 1 product
- Red Hat Openshift Data Foundation 4.22
Timeline
- 2026-10-02 Threatist record created from CVE-2026-25934
- 2026-10-03 Alias added: GHSA-37cx-329c-33x3
References
More Go-git vulnerabilities
- TI-2023-27070 Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients CVSS 3.1CRITICAL 9.8
- TI-2025-15573 go-git has an Argument Injection via the URL field CVSS 4.0CRITICAL 9.2
- TI-2025-15574 go-git clients vulnerable to DoS via maliciously crafted Git server replies CVSS 3.1HIGH 7.5
- TI-2023-27069 Maliciously crafted Git server replies can cause DoS on go-git clients CVSS 3.1HIGH 7.5
- TI-2026-30091 go-git Credential leak via cross-host redirect in smart HTTP transport CVSS 3.1HIGH 7.4
- TI-2026-32877 go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git CVSS 4.0HIGH 7.0
Sources
- CVE-2026-25934 · CVE Program
- CVE-2026-25934 · NVD
- FIRST EPSS
- GHSA-37cx-329c-33x3 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-25934 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences