CVE-2025-21614 go-git clients vulnerable to DoS via maliciously crafted Git server replies
Attackers can cause resource exhaustion and denial of service in go-git clients by sending maliciously crafted Git server responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-21614?
CVE-2025-21614 is a high-severity denial of service vulnerability in go-git, published on 6 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.
Weakness: CWE-400
Which versions are affected by CVE-2025-21614?
9 open source packages ship an affected version, including github.com/go-git/go-git/v5, github.com/go-git/go-git and github.com/go-git/go-git/v4. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/go-git/go-git/v5 Go | All versions | 5.13.0 |
github.com/go-git/go-git/v5 Go | All versions | 5.13.0 |
github.com/go-git/go-git/v5 Go | All versions | 5.13.0 |
github.com/go-git/go-git Go | From 4.0.0 to 4.13.1 | None |
github.com/go-git/go-git Go | From 4.0.0 to 4.13.1 | None |
github.com/go-git/go-git/v4 Go | From 4.0.0 | None |
3 more packages
gopkg.in/src-d/go-git.v4 Go | From 4.0.0 | None |
gopkg.in/src-d/go-git.v4 Go | From 4.0.0 to 4.13.1 | None |
gopkg.in/src-d/go-git.v4 Go | From 4.0.0 to 4.13.1 | None |
Products include Go-Git Project Go-Git.
How do I fix CVE-2025-21614?
Upgrade github.com/go-git/go-git/v5 to 5.13.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-21614 being exploited?
There is no known exploitation of CVE-2025-21614 in the wild and no public exploit code.
Other vulnerabilities in go-git
- CVE-2023-49569 Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients
- CVE-2025-21613 go-git has an Argument Injection via the URL field
- CVE-2023-49568 Maliciously crafted Git server replies can cause DoS on go-git clients
- CVE-2026-45022 go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git
- CVE-2026-45571 go-git: Crafted repositories may modify main and submodule .git directories
Sources
Also known as AZL-55063, AZL-55073, AZL-55079, AZL-55106, DEBIAN-CVE-2025-21614, GHSA-r9px-m959-cxf4 and 6 more.