PT-2025-1015 · Go-Git+9 · Go-Git+9

Bdilalu · Published 2025-01-06 · Updated 2026-03-12 · CVE-2025-21614

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions go-git versions prior to v5.13

Description A denial of service (DoS) vulnerability was discovered in go-git. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server, which triggers resource exhaustion in go-git clients.

Recommendations For versions prior to v5.13, upgrade to v5.13 to mitigate this vulnerability. As a temporary workaround, consider limiting the use of go-git to only trustworthy Git servers until a patch is available.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

RCE

Weakness Enumeration

CWE-770

CWE-400

CWE-20

Related Identifiers

ALSA-2025:0401

ALSA-2025_16880

AZL-55063

AZL-55073

AZL-55079

AZL-55106

BDU:2025-00211

CESA-2025_0401

CVE-2025-21614

ECHO-7B33-48F3-C82A

GHSA-R9PX-M959-CXF4

GO-2025-3367

INFSA-2025_0401

OPENSUSE-SU-2025:0056-1

OPENSUSE-SU-2025:14624-1

OPENSUSE-SU-2025:14634-1

OPENSUSE-SU-2025:15487-1

OPENSUSE-SU-2025:20117-1

OPENSUSE-SU-2025:20177-1

OPENSUSE-SU-2025_0060-1

OPENSUSE-SU-2026:20798-1

RHSA-2025:0401

RHSA-2025:0662

RHSA-2025_0401

RLSA-2025:0401

SUSE-SU-2025:0060-1

USN-8088-1

Affected Products

Almalinux

Centos

Debian

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

Go-Git

References · 116

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21614.json · Exploit
• https://github.com/go-git/go-git/security/advisories/GHSA-r9px-m959-cxf4 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2025:0401 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-55079 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15487-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-21614 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-21614 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r9px-m959-cxf4 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-21614 · Security Note
• https://ubuntu.com/security/CVE-2026-25934 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8088-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-21614 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-0401.html · Vendor Advisory
• https://osv.dev/vulnerability/AZL-55106 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:0056-1 · Vendor Advisory