Read the docs
TI-2026-32877 Aliases CVE-2026-45022GHSA-389r-gv7p-r3rp

go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git

Priority LOW 30CWE-180Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-345.

Summary

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-git’s decoded representation may expose values differently from how Git itself would interpret or reject the same object. Additionally, go-git’s commit signing and verification logic operates over commit data reconstructed from go-git’s parsed representation rather than the original raw object bytes. As a result, go-git may sign or verify a commit payload that is not byte-for-byte equivalent to the object stored in the repository. This can cause a signature to appear valid for a commit whose displayed or effective metadata differs from the object that was intended to be signed. This vulnerability is fixed in 5.19.0 and 6.0.0-alpha.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00159 5th percentileScored 2026-11-07
Fix Fixed go-git (go-git): 5.19.0, 6.0.0-alpha.3github.com/go-git/go-git/v6 (Go): 6.0.0-alpha.3+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
go-gitgo-gitbefore 5.19.0; 6.0.0-alpha.1 to before 6.0.0-alpha.35.19.0, 6.0.0-alpha.3Patch availableCNA
—github.com/go-git/go-git/v6 (Go)6.0.0-alpha.1 to before 6.0.0-alpha.36.0.0-alpha.3Patch availableGHSA-389r-gv7p-r3rp
—github.com/go-git/go-git/v5 (Go)before 5.19.05.19.0Patch availableGHSA-389r-gv7p-r3rp
  • go-git Vendorgo-git Affected before 5.19.0; 6.0.0-alpha.1 to before 6.0.0-alpha.3 Fixed in 5.19.0, 6.0.0-alpha.3 Patch available CNA
  • github.com/go-git/go-git/v6 (Go) Vendor— Affected 6.0.0-alpha.1 to before 6.0.0-alpha.3 Fixed in 6.0.0-alpha.3 Patch available GHSA-389r-gv7p-r3rp
  • github.com/go-git/go-git/v5 (Go) Vendor— Affected before 5.19.0 Fixed in 5.19.0 Patch available GHSA-389r-gv7p-r3rp

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:go-git_project:go-git:*:*:*:*:*:go:*:*before 5.19.0Vulnerablego-git
cpe:2.3:a:go-git_project:go-git:6.0.0:alpha1:*:*:*:go:*:*6.0.0 alpha1Vulnerablego-git
cpe:2.3:a:go-git_project:go-git:6.0.0:alpha2:*:*:*:go:*:*6.0.0 alpha2Vulnerablego-git
  • cpe:2.3:a:go-git_project:go-git:*:*:*:*:*:go:*:* Versions before 5.19.0 Vulnerable ·go-git
  • cpe:2.3:a:go-git_project:go-git:6.0.0:alpha1:*:*:*:go:*:* Versions 6.0.0 alpha1 Vulnerable ·go-git
  • cpe:2.3:a:go-git_project:go-git:6.0.0:alpha2:*:*:*:go:*:* Versions 6.0.0 alpha2 Vulnerable ·go-git

Remediation

  • Fix · CNA go-git (go-git) Fixed in 5.19.0, 6.0.0-alpha.3
  • Fix · GHSA-389r-gv7p-r3rp github.com/go-git/go-git/v6 (Go) Fixed in 6.0.0-alpha.3 Advisory →
  • Fix · GHSA-389r-gv7p-r3rp github.com/go-git/go-git/v5 (Go) Fixed in 5.19.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45022
  2. 2026-10-03 Alias added: GHSA-389r-gv7p-r3rp

References

Advisory 2

Other 1

  • TI-2023-27070 Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients CVSS 3.1CRITICAL 9.8
  • TI-2025-15573 go-git has an Argument Injection via the URL field CVSS 4.0CRITICAL 9.2
  • TI-2025-15574 go-git clients vulnerable to DoS via maliciously crafted Git server replies CVSS 3.1HIGH 7.5
  • TI-2023-27069 Maliciously crafted Git server replies can cause DoS on go-git clients CVSS 3.1HIGH 7.5
  • TI-2026-30091 go-git Credential leak via cross-host redirect in smart HTTP transport CVSS 3.1HIGH 7.4
  • TI-2026-33320 go-git: Crafted repositories may modify main and submodule .git directories CVSS 3.1MEDIUM 5.4
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences