CVE-2026-34165
ADVISORY - githubSummary
Impact
A vulnerability has been identified in which a maliciously crafted .idx file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a Denial of Service (DoS) condition.
Exploitation requires write access to the local repository's .git directory, it order to create or alter existing .idx files.
Patches
Users should upgrade to v5.17.1, or the latest v6 pseudo-version, in order to mitigate this vulnerability.
Credit
The go-git maintainers thank @kq5y for finding and reporting this issue privately to the go-git project.
GitHub
CVSS SCORE
5medium| Package | Type | OS Name | OS Version | Affected Ranges | Fix Versions |
|---|---|---|---|---|---|
| github.com/go-git/go-git/v5 | golang | - | - | >=5.0.0,<=5.17.0 | 5.17.1 |
| github.com/go-git/go-git/v5 | golang | - | - | >=0.0.0-20200315201832-9d0f15c4fa71,<=0.0.0-20260225124151-bdf06885bdaa | 0.0.0-20260225124151-bdf06885bdaa |
CVSS:3 Severity and metrics
The CVSS metrics represent different qualitative aspects of a vulnerability that impact the overall score, as defined by the CVSS Specification.
The vulnerable component is not bound to the network stack and the attacker's path is via read/write/execute capabilities. Either: The attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document).
Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success when attacking the vulnerable component.
The attacker requires privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.
Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited. For example, a successful exploit may only be possible during the installation of an application by a system administrator.
An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
There is no loss of confidentiality.
There is no loss of trust or accuracy within the impacted component.
There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component.
NIST
CVSS SCORE
5mediumDebian
-
Ubuntu
-
CVSS SCORE
N/AmediumGoLang
-
Chainguard
CGA-m74g-hr5c-wfmv
-
minimos
MINI-25rj-cgq8-72hc
-
minimos
MINI-28pf-w58w-9cjv
-
minimos
MINI-2ph9-6h7c-j3vr
-
minimos
MINI-2xj6-g8r5-rxrv
-
minimos
MINI-33cj-j7v7-c96x
-
minimos
MINI-34rw-jmr4-58q9
-
minimos
MINI-37mm-3pc9-38w9
-
minimos
MINI-396x-49hg-7h5w
-
minimos
MINI-3rh9-79fr-hmjr
-
minimos
MINI-3xcc-xg6c-cjg2
-
minimos
MINI-45hg-2286-q395
-
minimos
MINI-4fv9-9x6m-j59c
-
minimos
MINI-4vw4-mqf2-3cgw
-
minimos
MINI-4whq-f92g-92xj
-
minimos
MINI-528v-hw48-4qcf
-
minimos
MINI-52h9-gjvc-mjpf
-
minimos
MINI-56m8-7fj6-w2c4
-
minimos
MINI-57qf-v7r2-w3cj
-
minimos
MINI-5g3m-4w42-6h8j
-
minimos
MINI-5qxh-hqrj-9w49
-
minimos
MINI-63vj-4cfr-4qhr
-
minimos
MINI-6458-54g2-qvmx
-
minimos
MINI-646j-3v4m-f39c
-
minimos
MINI-65gx-pq8q-5qrq
-
minimos
MINI-65h9-9wjg-9j9x
-
minimos
MINI-66f8-3r6x-3gxr
-
minimos
MINI-66hm-mqgh-x4h7
-
minimos
MINI-6p44-j4cr-mr9c
-
minimos
MINI-6xx8-x3hv-rqpp
-
minimos
MINI-734q-3vxf-x93r
-
minimos
MINI-74q9-798g-9fp3
-
minimos
MINI-75w6-mrr6-898p
-
minimos
MINI-77rm-v3jm-gh6j
-
minimos
MINI-785h-ffqj-cwxp
-
minimos
MINI-7f67-ccf3-8p2c
-
minimos
MINI-7vm2-f8m3-g3qm
-
minimos
MINI-8fjm-q57x-h7vm
-
minimos
MINI-8gqr-2pxj-5rwj
-
minimos
MINI-8qg5-7gg7-c54m
-
minimos
MINI-9j6w-c386-5v68
-
minimos
MINI-9m72-8gh4-mcqw
-
minimos
MINI-9q6v-jx44-pmhw
-
minimos
MINI-c557-vvv7-crqq
-
minimos
MINI-c7vr-vfq8-9xrg
-
minimos
MINI-ccgx-5chc-gqvv
-
minimos
MINI-cfr7-j6v2-594r
-
minimos
MINI-ch89-qh27-gx56
-
minimos
MINI-cw52-g6w5-p42c
-
minimos
MINI-f36h-6vmv-xr7w
-
minimos
MINI-f555-w8f7-76cf
-
minimos
MINI-f8q3-883w-58vg
-
minimos
MINI-f9q7-3vwm-r5rx
-
minimos
MINI-f9xw-cgmp-mf63
-
minimos
MINI-fmh3-x2p7-wjxf
-
minimos
MINI-fv7c-c3v3-mp8h
-
minimos
MINI-fwc5-gc5g-mvvx
-
minimos
MINI-g5hq-cgg6-f3mw
-
minimos
MINI-gcg5-jxwj-24g5
-
minimos
MINI-gf35-ccph-hp9w
-
minimos
MINI-gfcf-9jqj-75c5
-
minimos
MINI-gpcf-p6g4-jrqj
-
minimos
MINI-h64w-cc96-jhxw
-
minimos
MINI-hmq5-j88j-4j55
-
minimos
MINI-hqj5-8xfh-89rm
-
minimos
MINI-hqq5-hr4h-v83g
-
minimos
MINI-hxmc-25jq-8jh6
-
minimos
MINI-j2hx-737r-wc3j
-
minimos
MINI-j4hw-c5g7-9gm3
-
minimos
MINI-j7hg-x6h7-w4q8
-
minimos
MINI-jf2j-wj33-vwfm
-
minimos
MINI-jf5m-925c-58wr
-
minimos
MINI-jj4w-6r77-gf58
-
minimos
MINI-jm5c-vhf7-hwm6
-
minimos
MINI-m4m6-3m7p-xh83
-
minimos
MINI-m55w-rrqg-chpw
-
minimos
MINI-m896-vxvr-mj5f
-
minimos
MINI-mgg6-55xq-v24x
-
minimos
MINI-mq2p-3qjj-mwv9
-
minimos
MINI-p7q3-pjj4-8j8g
-
minimos
MINI-p8f2-jc7x-x7gq
-
minimos
MINI-phh3-xmv3-jgh7
-
minimos
MINI-pj53-wvq2-xvjr
-
minimos
MINI-pj7x-pp2g-wr32
-
minimos
MINI-pw95-wxv5-v5v8
-
minimos
MINI-q52g-rrw9-c8qv
-
minimos
MINI-q87f-wcq2-8w62
-
minimos
MINI-qcmx-fh74-g4xm
-
minimos
MINI-qf83-q6jx-9vhj
-
minimos
MINI-qg6v-mg8m-5x7w
-
minimos
MINI-qgqp-wf46-5876
-
minimos
MINI-qwgf-vxcv-vg4m
-
minimos
MINI-rhgq-67m5-h8wm
-
minimos
MINI-rmx5-26hx-5fh8
-
minimos
MINI-rqr5-c946-pgpc
-
minimos
MINI-rwhf-crjg-3734
-
minimos
MINI-v349-m59p-vh3g
-
minimos
MINI-v49x-rhpv-mg93
-
minimos
MINI-v9vc-vhhq-w9j8
-
minimos
MINI-vj8v-jhjq-ggqc
-
minimos
MINI-vwm8-rcpr-v948
-
minimos
MINI-vxr8-q66j-g39g
-
minimos
MINI-w22x-42pp-h872
-
minimos
MINI-w2p7-hmcr-gxmg
-
minimos
MINI-w43w-xf49-5642
-
minimos
MINI-w88w-4g3m-8c8j
-
minimos
MINI-wggp-x6qh-w3rp
-
minimos
MINI-whv8-498x-6j95
-
minimos
MINI-wppq-747c-vm4w
-
minimos
MINI-wrc5-qgvm-8729
-
minimos
MINI-wv6p-38xv-f23m
-
minimos
MINI-wvmm-h4gc-8x3p
-
minimos
MINI-wx89-x723-x8mw
-
minimos
MINI-x7q2-6pc6-hq4h
-
minimos
MINI-xm5p-6gvc-m6xg
-
minimos
MINI-xr7x-r3wm-43v6
-
minimos
MINI-xrf6-mcp2-3368
-