CVE-2026-33762
ADVISORY - githubSummary
Impact
go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing.
This issue only affects Git index format version 4. Earlier formats (go-git supports only v2 and v3) are not vulnerable to this issue.
An attacker able to supply a crafted .git/index file can cause applications using go-git to panic while reading the index. If the application does not recover from panics, this results in process termination, leading to a denial-of-service (DoS) condition.
Exploitation requires the ability to modify or inject a Git index file within the local repository in disk. This typically implies write access to the .git directory.
Patches
Users should upgrade to v5.17.1, or the latest v6 pseudo-version, in order to mitigate this vulnerability.
Credit
go-git maintainers thank @kq5y for finding and reporting this issue privately to the go-git project.
Common Weakness Enumeration (CWE)
Improper Validation of Array Index
Improper Validation of Array Index
GitHub
1.3
CVSS SCORE
2.8low| Package | Type | OS Name | OS Version | Affected Ranges | Fix Versions |
|---|---|---|---|---|---|
| github.com/go-git/go-git/v5 | golang | - | - | <=5.17.0 | 5.17.1 |
| github.com/go-git/go-git/v5 | golang | - | - | <0.0.0-20260328142655-5e23dfd02db9 | 0.0.0-20260328142655-5e23dfd02db9 |
CVSS:3 Severity and metrics
The CVSS metrics represent different qualitative aspects of a vulnerability that impact the overall score, as defined by the CVSS Specification.
The vulnerable component is not bound to the network stack and the attacker's path is via read/write/execute capabilities. Either: The attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document).
Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success when attacking the vulnerable component.
The attacker requires privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.
Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited. For example, a successful exploit may only be possible during the installation of an application by a system administrator.
An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
There is no loss of confidentiality.
There is no loss of trust or accuracy within the impacted component.
Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the impacted component are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the impacted component.
NIST
1.3
CVSS SCORE
2.8lowDebian
-
Ubuntu
-
CVSS SCORE
N/AmediumGoLang
-
Chainguard
CGA-9gc9-qwwq-vf3j
-
minimos
MINI-243q-qvq2-6mq6
-
minimos
MINI-2486-p68p-5gp6
-
minimos
MINI-2956-3qrx-mw79
-
minimos
MINI-3285-2839-mh97
-
minimos
MINI-329c-hf9c-6x58
-
minimos
MINI-3fhx-cj8x-44x7
-
minimos
MINI-3pmf-85qf-jq4c
-
minimos
MINI-3x6h-jggj-3rpw
-
minimos
MINI-42vm-pvp5-rwr5
-
minimos
MINI-4365-mq9x-jrqw
-
minimos
MINI-4g4r-5q6q-c42v
-
minimos
MINI-4g7q-3rvc-cqpc
-
minimos
MINI-4pw7-9v4r-c54v
-
minimos
MINI-54fp-78h9-925p
-
minimos
MINI-55qp-gr9r-gm34
-
minimos
MINI-5hv6-2gm5-qm5c
-
minimos
MINI-5rgg-c2mq-rgj8
-
minimos
MINI-5w42-4c5x-jf54
-
minimos
MINI-63mr-9467-x6vw
-
minimos
MINI-6426-cw8v-547f
-
minimos
MINI-6457-8pc8-pj57
-
minimos
MINI-6625-jp7j-q5x4
-
minimos
MINI-6mmq-wp6m-v5f3
-
minimos
MINI-6v83-x2m6-qrvx
-
minimos
MINI-6w5h-8vgx-8hfm
-
minimos
MINI-7f97-mxqp-mgpv
-
minimos
MINI-7fp2-377m-6f2g
-
minimos
MINI-7j88-xjq4-3v5x
-
minimos
MINI-7q8h-m4qv-689c
-
minimos
MINI-8ffr-fwhg-gj65
-
minimos
MINI-8gmf-j8j8-3jw7
-
minimos
MINI-8h62-66v8-qf5q
-
minimos
MINI-8vrf-3xcp-c8xm
-
minimos
MINI-8x23-f5f5-phpf
-
minimos
MINI-92jr-rwwf-cvc8
-
minimos
MINI-937h-q9rq-43rm
-
minimos
MINI-9cvx-f77h-cfh4
-
minimos
MINI-c9jr-579f-xvxp
-
minimos
MINI-cm9c-qv6h-63rv
-
minimos
MINI-crgq-8897-p3gv
-
minimos
MINI-cv2q-jj8v-qh5g
-
minimos
MINI-cv63-5rhp-6r36
-
minimos
MINI-cvf7-vr8w-4hmw
-
minimos
MINI-cx34-w5pm-39j8
-
minimos
MINI-fh3r-3wcq-chch
-
minimos
MINI-fm3p-874h-mcp5
-
minimos
MINI-fp99-6x64-j2wx
-
minimos
MINI-fr98-w2q3-vgcx
-
minimos
MINI-g7hx-p2q7-vmpp
-
minimos
MINI-g8fr-vvqv-8rxq
-
minimos
MINI-ghf3-73q7-mmwh
-
minimos
MINI-gj68-ccxm-wrgr
-
minimos
MINI-gp5c-mvrh-jvfm
-
minimos
MINI-h954-hqfq-v595
-
minimos
MINI-h9hx-hwcj-fmm2
-
minimos
MINI-hg27-4w8q-8fgh
-
minimos
MINI-hgg7-332c-82rg
-
minimos
MINI-hhj8-924h-4xj9
-
minimos
MINI-hj9v-p45w-jq24
-
minimos
MINI-hqwq-qcqv-gmjw
-
minimos
MINI-hrrc-m783-vj3g
-
minimos
MINI-j3rq-g2m4-fxhw
-
minimos
MINI-j84m-79q2-p97m
-
minimos
MINI-m25p-xvjh-p36v
-
minimos
MINI-m56j-wxf2-rcpm
-
minimos
MINI-m623-9gcr-m429
-
minimos
MINI-m64j-r5cg-5cmq
-
minimos
MINI-m7wq-mg28-p3qp
-
minimos
MINI-mcf5-84qx-p58r
-
minimos
MINI-mvg8-8x47-7fr4
-
minimos
MINI-mx82-fpr5-mffm
-
minimos
MINI-p45q-76x2-p994
-
minimos
MINI-p8wm-5wm2-8v26
-
minimos
MINI-p97w-wgqm-fgqr
-
minimos
MINI-pf99-6x43-qv2v
-
minimos
MINI-phpj-h6gm-cpvq
-
minimos
MINI-pjf3-qpgx-gwr8
-
minimos
MINI-pmvc-h3wc-qj47
-
minimos
MINI-pphj-f63j-7353
-
minimos
MINI-pqvm-wp84-q6cx
-
minimos
MINI-pvrq-prpp-h7fr
-
minimos
MINI-pw2r-6rvq-jqf9
-
minimos
MINI-q42q-pwpg-589v
-
minimos
MINI-q6pc-58m3-2xx2
-
minimos
MINI-q7j9-692c-w74h
-
minimos
MINI-q88c-qqg4-f7v5
-
minimos
MINI-q8x5-6qf5-82xv
-
minimos
MINI-qffh-9vmh-2j2m
-
minimos
MINI-qr8g-fpjg-m75j
-
minimos
MINI-qrpx-mc29-x6vq
-
minimos
MINI-r2c8-fjj7-j5m2
-
minimos
MINI-rhmr-4wgr-h9xg
-
minimos
MINI-rj8q-6698-cmgq
-
minimos
MINI-rjwj-8jh5-mqx2
-
minimos
MINI-rr2f-w8vr-gp5w
-
minimos
MINI-rxw2-fj7v-8mpx
-
minimos
MINI-v664-55h2-vgqw
-
minimos
MINI-vc43-575h-mwph
-
minimos
MINI-vg98-2mrx-m84w
-
minimos
MINI-vhvq-hvqp-5mrx
-
minimos
MINI-vm6c-2pvq-2j5g
-
minimos
MINI-vp2q-fvg3-6jwx
-
minimos
MINI-vwr9-p82j-vr8q
-
minimos
MINI-w39w-h77h-8c5h
-
minimos
MINI-w86v-rhch-p892
-
minimos
MINI-w967-cxhx-pmwg
-
minimos
MINI-wc22-52jp-9frv
-
minimos
MINI-wc73-63mf-jf7h
-
minimos
MINI-wpcm-q63j-q45j
-
minimos
MINI-wv9j-j4m6-pmw5
-
minimos
MINI-wxqm-7q3c-m5x4
-
minimos
MINI-x5mm-8pv2-996h
-
minimos
MINI-xfh7-fmwg-6pgv
-
minimos
MINI-xh2p-948g-8q3w
-
minimos
MINI-xj84-c6xc-6p6h
-
minimos
MINI-xjg5-cp55-vqrr
-