CVE-2026-25934 go-git improperly verifies data integrity values for .idx and .pack files
Attackers can cause denial of service in go-git by providing corrupted pack files that bypass integrity checks, leading to unexpected errors.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-25934?
CVE-2026-25934 is a medium-severity vulnerability in go-git, published on 9 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.
Weakness: CWE-354
Which versions are affected by CVE-2026-25934?
5 open source packages ship an affected version, including github.com/go-git/go-git/v5, github.com/go-git/go-git and github.com/go-git/go-git/v4. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/go-git/go-git/v5 Go | All versions | 5.16.5 |
github.com/go-git/go-git/v5 Go | All versions | 5.16.5 |
github.com/go-git/go-git/v5 Go | All versions | 5.16.5 |
github.com/go-git/go-git Go | All versions | None |
github.com/go-git/go-git/v4 Go | All versions | None |
Products include Go-Git Project Go-Git.
How do I fix CVE-2026-25934?
Upgrade github.com/go-git/go-git/v5 to 5.16.5 or later.
Is CVE-2026-25934 being exploited?
There is no known exploitation of CVE-2026-25934 in the wild and no public exploit code.
Other vulnerabilities in go-git
- CVE-2023-49569 Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients
- CVE-2025-21613 go-git has an Argument Injection via the URL field
- CVE-2025-21614 go-git clients vulnerable to DoS via maliciously crafted Git server replies
- CVE-2023-49568 Maliciously crafted Git server replies can cause DoS on go-git clients
- CVE-2026-45022 go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git
Sources
Also known as CLEANSTART-2026-AR15504, CLEANSTART-2026-BJ08880, CLEANSTART-2026-MJ31309, DEBIAN-CVE-2026-25934, GHSA-37cx-329c-33x3, GO-2026-4473 and 82 more.