{"id":"GO-2026-5693","aliases":["GHSA-w5pp-99ch-qj29"],"title":"Go-git: Malformed Git object data may cause panics or resource exhaustion in github.com/go-git/go-git","summary":"Go-git: Malformed Git object data may cause panics or resource exhaustion in github.com/go-git/go-git","severity":"none","vendor":"go-git","product":"github.com/go-git/go-git/v5","ecosystem":"go","affected":["github.com/go-git/go-git/v5 < 5.19.1","github.com/go-git/go-git/v6 < 6.0.0-alpha.4"],"patched":["github.com/go-git/go-git/v5 5.19.1","github.com/go-git/go-git/v6 6.0.0-alpha.4"],"published":"2026-07-24","updated":"2026-07-24","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-5693","references":[{"url":"https://github.com/go-git/go-git/security/advisories/GHSA-w5pp-99ch-qj29"}],"tags":["osv","go"],"ingestedAt":"2026-07-25T19:08:12.774Z","slug":"GO-2026-5693","body":"## Overview\n\nGo-git: Malformed Git object data may cause panics or resource exhaustion in github.com/go-git/go-git\n\n## Affected packages\n\n- `github.com/go-git/go-git/v5 < 5.19.1`\n- `github.com/go-git/go-git/v6 < 6.0.0-alpha.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/go-git/go-git/v5 5.19.1`\n- `github.com/go-git/go-git/v6 6.0.0-alpha.4`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}