Ionuț Lalu

**Name of the Vulnerable Software and Affected Versions** go-git versions prior to v5.11 **Description** A denial of service (DoS) vulnerability was discovered in go-git. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server, which triggers resource exhaustion in go-git clients. Applications using only the in-memory filesystem supported by go-git are not affected by this vulnerability. This is a go-git implementation issue and does not affect the upstream git cli. **Recommendations** For go-git versions prior to v5.11, upgrade to v5.11 to mitigate this vulnerability. As a temporary workaround, consider limiting the use of go-git to only trustworthy Git servers if upgrading to v5.11 is not possible.

**Name of the Vulnerable Software and Affected Versions** go-git versions prior to v5.11 **Description** A path traversal vulnerability was discovered in go-git, allowing an attacker to create and amend files across the filesystem. In the worst-case scenario, remote code execution could be achieved. Applications are only affected if they are using the ChrootOS, which is the default when using "Plain" versions of Open and Clone functions. Applications using BoundOS or in-memory filesystems are not affected by this issue. This is a go-git implementation issue and does not affect the upstream git cli. **Recommendations** For versions prior to v5.11, upgrade to v5.11 to mitigate this vulnerability. As a temporary workaround, consider limiting the use of go-git to only trustworthy Git servers. Restrict access to the ChrootOS to minimize the risk of exploitation. Avoid using the "Plain" versions of Open and Clone functions until the issue is resolved.