PT-2026-29159 · Go-Git · Go-Git

Kq5Y · Published 2026-03-30 · Updated 2026-05-18 · CVE-2026-34165

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions go-git versions 5.0.0 through 5.17.0

Description A crafted .idx file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a denial-of-service (DoS) condition. Exploitation requires write access to the local repository's .git directory to create or alter existing .idx files.

Recommendations Upgrade to version 5.17.1 or later.

Exploit

Fix

Allocation of Resources Without Limits

Integer Underflow

Weakness Enumeration

CWE-770

CWE-191

Related Identifiers

CLEANSTART-2026-BU65096

CLEANSTART-2026-DQ17669

CLEANSTART-2026-ET12387

CLEANSTART-2026-FV86809

CLEANSTART-2026-GN78570

CLEANSTART-2026-JG72006

CLEANSTART-2026-LO26058

CLEANSTART-2026-LU21824

CLEANSTART-2026-ML41879

CLEANSTART-2026-NR54556

CLEANSTART-2026-NT80635

CLEANSTART-2026-TT42218

CLEANSTART-2026-VT65447

CVE-2026-34165

GHSA-JHF3-XXHW-2WPP

GO-2026-4910

OPENSUSE-SU-2026:10509-1

OPENSUSE-SU-2026:10684-1

Affected Products

Go-Git

References · 175

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34165.json · Exploit
• https://github.com/go-git/go-git/security/advisories/GHSA-jhf3-xxhw-2wpp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33252 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-1229 · Security Note
• https://ubuntu.com/security/CVE-2026-34165 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27139 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-26958 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34742 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-35469 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-58187 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34165 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-34165 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33762 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-41506 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32282 · Security Note