go-git vulnerabilities
CVEs whose affected-version data names the go-git package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-34165Medium· 5.0go-git is an extensible git implementation library written in pure Go
go-git is an extensible git implementation library written in pure Go. From version 5.0.0 to before version 5.17.1, a vulnerability has been identified in which a maliciously crafted .idx file can cause asymmetric memory consumption, pot…
▾ Sunlitgo-git_project · go-gitEPSS 0.15%via NVD
CVE-2026-33762Low· 2.8go-git is an extensible git implementation library written in pure Go
go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path n…
▾ Sunlitgo-git_project · go-gitEPSS 0.15%via NVD