CVE-2026-33762 go-git: Missing validation decoding Index v4 files leads to panic
A maliciously crafted Git index file can cause a runtime panic in go-git, leading to denial of service during index parsing.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-33762?
CVE-2026-33762 is a low-severity denial of service vulnerability in go-git, published on 31 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing. This issue only affects Git index format version 4. Earlier formats (go-git supports only v2 and v3) are not vulnerable to this issue. This issue has been patched in version 5.17.1.
Weakness: CWE-129
Which versions are affected by CVE-2026-33762?
5 open source packages ship an affected version, including github.com/go-git/go-git/v5, github.com/go-git/go-git and github.com/go-git/go-git/v4. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/go-git/go-git/v5 Go | All versions | 5.17.1 |
github.com/go-git/go-git/v5 Go | All versions | 5.17.1 |
github.com/go-git/go-git/v5 Go | All versions | 5.17.1 |
github.com/go-git/go-git Go | All versions | None |
github.com/go-git/go-git/v4 Go | All versions | None |
Products include Go-Git Project Go-Git.
How do I fix CVE-2026-33762?
Upgrade github.com/go-git/go-git/v5 to 5.17.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-33762 being exploited?
There is no known exploitation of CVE-2026-33762 in the wild and no public exploit code.
Other vulnerabilities in go-git
- CVE-2023-49569 Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients
- CVE-2025-21613 go-git has an Argument Injection via the URL field
- CVE-2025-21614 go-git clients vulnerable to DoS via maliciously crafted Git server replies
- CVE-2023-49568 Maliciously crafted Git server replies can cause DoS on go-git clients
- CVE-2026-45022 go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git
Sources
Also known as CLEANSTART-2026-LL04438, CLEANSTART-2026-TG93279, CLEANSTART-2026-ZD82952, DEBIAN-CVE-2026-33762, GHSA-gm2x-2g9h-ccm8, GO-2026-4909 and 118 more.