CVE-2026-45022 go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git

What is CVE-2026-45022?

CVE-2026-45022 is a high-severity vulnerability in go-git, published on 27 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-git’s decoded representation may expose values differently from how Git itself would interpret or reject the same object. Additionally, go-git’s commit signing and verification logic operates over commit data reconstructed from go-git’s parsed representation rather than the original raw object bytes. As a result, go-git may sign or verify a commit payload that is not byte-for-byte equivalent to the object stored in the repository. This can cause a signature to appear valid for a commit whose displayed or effective metadata differs from the object that was intended to be signed. This vulnerability is fixed in 5.19.0 and 6.0.0-alpha.3.

Weakness: CWE-345, CWE-180

Which versions are affected by CVE-2026-45022?

5 open source packages ship an affected version, including github.com/go-git/go-git/v5 and github.com/go-git/go-git/v6. It affects 1 product.

Products include Go-Git Project Go-Git.

How do I fix CVE-2026-45022?

Upgrade github.com/go-git/go-git/v5 to 5.19.0 or later.

Is CVE-2026-45022 being exploited?

There is no known exploitation of CVE-2026-45022 in the wild and no public exploit code.

Other vulnerabilities in go-git

• CVE-2023-49569 Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients Critical 9.8
• CVE-2025-21613 go-git has an Argument Injection via the URL field Critical 9.2
• CVE-2025-21614 go-git clients vulnerable to DoS via maliciously crafted Git server replies High 7.5
• CVE-2023-49568 Maliciously crafted Git server replies can cause DoS on go-git clients High 7.5
• CVE-2026-45571 go-git: Crafted repositories may modify main and submodule .git directories Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BELL-CVE-2026-45022, CLEANSTART-2026-CD37394, CLEANSTART-2026-QM97024, CLEANSTART-2026-RC37242, CLEANSTART-2026-WJ78227, DEBIAN-CVE-2026-45022 and 183 more.