PT-2026-29156 · Go-Git+1 · Go-Git+1
CVSS v3.1
2.8
Low
| Vector | AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
go-git versions prior to 5.17.1
Description
The
go-git library’s index decoder for Git index format version 4 does not properly validate the path name prefix length before applying it to the previously decoded path name. A specially crafted index file can cause an out-of-bounds slice operation, leading to a runtime panic during index parsing. This issue only affects Git index format version 4. An attacker with the ability to modify or inject a Git index file within a local repository can cause applications using go-git to terminate, resulting in a denial-of-service (DoS) condition.Recommendations
Upgrade to version 5.17.1, or the latest version 6.
Exploit
Fix
DoS
Improper Validation of Array Index
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Red Os
Go-Git