CVE-2023-49568 Maliciously crafted Git server replies can cause DoS on go-git clients
Attackers can cause resource exhaustion and denial of service in go-git clients by sending maliciously crafted Git server responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-49568?
CVE-2023-49568 is a high-severity denial of service vulnerability in go-git, published on 12 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients.
Applications using only the in-memory filesystem supported by go-git are not affected by this vulnerability. This is a go-git implementation issue and does not affect the upstream git cli.
Weakness: CWE-20
Which versions are affected by CVE-2023-49568?
6 open source packages ship an affected version, including github.com/go-git/go-git/v5 and gopkg.in/src-d/go-git.v4. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/go-git/go-git/v5 Go | All versions | 5.11.0 |
github.com/go-git/go-git/v5 Go | All versions | 5.11.0 |
github.com/go-git/go-git/v5 Go | From 5.0.0 | 5.11.0 |
gopkg.in/src-d/go-git.v4 Go | From 4.7.1 | None |
gopkg.in/src-d/go-git.v4 Go | From 4.7.1 to 4.13.1 | None |
gopkg.in/src-d/go-git.v4 Go | From 4.7.1 to 4.13.1 | None |
Products include Go-Git Project Go-Git.
How do I fix CVE-2023-49568?
Upgrade github.com/go-git/go-git/v5 to 5.11.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-49568 being exploited?
There is no known exploitation of CVE-2023-49568 in the wild and no public exploit code.
Other vulnerabilities in go-git
- CVE-2023-49569 Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients
- CVE-2025-21613 go-git has an Argument Injection via the URL field
- CVE-2025-21614 go-git clients vulnerable to DoS via maliciously crafted Git server replies
- CVE-2026-45022 go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git
- CVE-2026-45571 go-git: Crafted repositories may modify main and submodule .git directories
Sources
Also known as AZL-33892, AZL-35095, AZL-39595, CLEANSTART-2026-XB80449, DEBIAN-CVE-2023-49568, GHSA-mw99-9chc-xw7r and 2 more.