GitHub Advisoryadvisory · Go

GHSA-jhf3-xxhw-2wpp go-git: Maliciously crafted idx file can cause asymmetric memory consumption

MEDIUM Published 2026-03-30 Modified 2026-03-31 Official page ↗
Aliases
CVE-2026-34165
Ecosystem
Go
Packages
github.com/go-git/go-git/v5
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-191, CWE-770
Reviewed
2026-03-30

Affected packages

• Go github.com/go-git/go-git/v5: >= 5.0.0, < 5.17.1 → fixed in 5.17.1

Description

Impact A vulnerability has been identified in which a maliciously crafted `.idx` file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a Denial of Service (DoS) condition. Exploitation requires write access to the local repository's `.git` directory, it order to create or alter existing `.idx` files. Patches Users should upgrade to `v5.17.1`, or the latest `v6` pseudo-version, in order to mitigate this vulnerability. Credit The go-git maintainers thank @kq5y for finding and reporting this issue privately to the `go-git` project.

Related

Alias · CVE (1)

  • CVE-2026-34165 go-git is an extensible git implementation library written in pure Go. vulnerability

Weakness · CWE (2)

  • CWE-191 Integer Underflow (Wrap or Wraparound) weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References