go-git vulnerabilities

CVEs per yearBy the year they were published

1. 20242
2. 20252
3. 202611

Newest CVEs

• CVE-2026-71557

  go-git: Malicious reference names may modify files outside the reference storage

  go-git · go-git

  Medium6.3
• CVE-2026-71556

  go-git: Worktree operations may follow symlinks

  go-git · go-git

  High7.1
• CVE-2026-44740

  go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

  go-git · go-billy

  Medium6.5
• CVE-2026-44973

  Billy: Path traversal vulnerabilities

  go-git · go-billy

  High8.1
• CVE-2026-45570

  go-git: Improper single-quote escaping in go-git SSH transport

  go-git · go-git

  Low2.3
• CVE-2026-45571

  go-git: Crafted repositories may modify main and submodule .git directories

  go-git · go-git

  Medium5.4
• CVE-2026-45022

  go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git

  go-git · go-git

  High7.0
• CVE-2026-41506

  go-git Credential leak via cross-host redirect in smart HTTP transport

  go-git · go-git

  Medium4.7
• CVE-2026-33762

  go-git: Missing validation decoding Index v4 files leads to panic

  go-git · go-git

  Low2.8
• CVE-2026-34165

  go-git: Maliciously crafted idx file can cause asymmetric memory consumption

  go-git · go-git

  Medium5.0