CVE-2023-49568

CVE-2023-49568 affects go-git (Go) and is a DoS due to specially crafted responses from a Git server triggering resource exhaustion in go-git clients. Affected are go-git versions prior to v5.11; in-memory filesystem usage by go-git is not affected. This is a go-git implementation issue and does ...

CVE-2025-21614

CVE-2025-21614: A DoS vulnerability in the Go Git implementation (go-git) affects versions prior to v5.13. The issue allows an attacker to exhaust resources in go-git clients by returning specially crafted responses from a Git server. Mitigation: upgrade from v4 to v5.13 or later. The description...

CVE-2026-45022

CVE-2026-45022 affects the Go Git library, go-git, where prior to v5.19.0 and v6.0.0-alpha.3 it may parse malformed commit/tag objects differently from upstream Git. The decoded representation can expose values differently and the commit signing/verification may operate on reconstructed data rath...

CVE-2026-41506

go-git is vulnerable to credential leakage during smart-HTTP redirects in clone/fetch operations prior to versions 5.18.0 and 6.0.0-alpha.2. The issue, a cross-host redirect exposure, has been patched in 5.18.0 and 6.0.0-alpha.2. Impact is a potential exposure of HTTP credentials during redirects...