CVE-2026-45022

ADVISORY - github

Summary

Impact

go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-git’s decoded representation may expose values differently from how Git itself would interpret or reject the same object.

Additionally, go-git’s commit signing and verification logic operates over commit data reconstructed from go-git’s parsed representation rather than the original raw object bytes. As a result, go-git may sign or verify a commit payload that is not byte-for-byte equivalent to the object stored in the repository.

This can cause a signature to appear valid for a commit whose displayed or effective metadata differs from the object that was intended to be signed.

Patches

Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-git version.

Credit

Thanks to @bugbunny-research (https://bugbunny.ai/) for reporting this to sigstore/gitsign, and to @wlynch, @patzielinski and @adityasaky for coordinating the disclosure with the go-git project. :bow: :1st_place_medal:

Thanks to @wayphinder for reporting this to the go-git project. :bow:

Common Weakness Enumeration (CWE)

ADVISORY - github

GitHub

CREATED

1 day ago

UPDATED

1 day ago

ADVISORY IDGHSA-389r-gv7p-r3rp⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-180⁠CWE-345⁠

CVSS SCORE

7high

Chainguard

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

CGA-8x53-pqv6-wqhw

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-2945-rqgx-7j7m

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-3pcr-9m8g-c6cq

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-432f-vrwf-gpcp

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-56f9-r345-8g9v

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-59jc-23xj-q9gf

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-5fw6-hxg6-62cg

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-5w74-jj2v-474g

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-5wxv-48r4-53v5

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-8427-w35w-p75x

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-8rvf-5pc5-x5pj

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-93pq-qcvf-4gf4

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-95fq-pg9m-68px

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-9c7x-4xx5-g5p6

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-9gcp-5pf5-j3xq

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-9mmf-wxw4-rqfw

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-c9wr-55r8-6xgg

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-fq47-mx76-j4g9

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-fvc4-hf5h-38h3

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-fvw9-jfq3-xwvq

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-h86g-g7mj-vjvr

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-hc37-5c89-6g7v

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-hw6w-248v-mfvm

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-mhgx-5w95-pj5v

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-mj8q-r53c-h4w7

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-mw87-vp7g-cxp2

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-pjmm-j7x4-jhr9

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-pw74-wh35-5mrg

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-q782-wg8x-r5qx

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-qfw4-93x7-p459

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-r28f-g489-484q

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-r3jj-9rr2-77wv

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-r6qh-c4px-w4x6

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-r86c-6r24-5jpr

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-rr29-98m4-63r4

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-vqx4-g3m9-vpfj

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-vwp8-fm9j-69qj

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-w77p-2r43-qv96

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-wfjj-3m87-pq9m

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-wvj8-874x-rmwp

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

6 hours ago

UPDATED

6 hours ago

ADVISORY ID

MINI-x334-977m-754q

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

CVE-2026-45022

Summary

Impact

Patches

Credit

Common Weakness Enumeration (CWE)

CWE-180⁠

CWE-345⁠

Advisories

GitHub

CVSS SCORE

Chainguard

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos

minimos