← Vulnerability feed

Vulnerability record · CVE-2026-33762 · published 31 March 2026

CVE-2026-33762: Go-git project go-git vulnerability

GGo Git Project · Go Git

go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing. This issue only affects Git index format version 4. Earlier formats (go-git supports only v2 and v3) are not vulnerable to this issue. This issue has been patched in version 5.17.1.

2.8 CVSS 3.1 Low EPSS 0.15% · top 96.2% CWE-129 · CWE-129
2.8CVSS 3.1 base score
0.15%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
24 Jul 2026Last modified by NVD

Description

go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing. This issue only affects Git index format version 4. Earlier formats (go-git supports only v2 and v3) are not vulnerable to this issue. This issue has been patched in version 5.17.1.

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/go-git/go-git/releases/tag/v5.17.1 ProductRelease Notes
https://github.com/go-git/go-git/security/advisories/GHSA-gm2x-2g9h-ccm8 Vendor Advisory

Track CVE-2026-33762 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-49569Go-git project go-git path traversal vulnerabilityA path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files acro…EPSS 1.5%9.2CVE-2025-21613Go-git project go-git argument injection vulnerabilitygo-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions pr…EPSS 1.3%7.5CVE-2025-21614Go-git project go-git uncontrolled resource consumption vulnerabilitygo-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git version…EPSS 0.72%7.5CVE-2023-49568Go-git project go-git improper input validation vulnerabilityA denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of …EPSS 0.70%7.4CVE-2026-41506Go-git project go-git insufficiently protected credentials vulnerabilitygo-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authenticatio…EPSS 0.26%7.0CVE-2026-45022Go-git project go-git insufficient verification of data authenticity vulnerabilitygo-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a…EPSS 0.16%5.4CVE-2026-45571Go-git project go-git path traversal vulnerabilitygo-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could all…EPSS 0.33%5.0CVE-2026-34165Go-git project go-git allocation without limits vulnerabilitygo-git is an extensible git implementation library written in pure Go. From version 5.0.0 to before version 5.17.1, a vulnerability has been identifi…EPSS 0.15%

Source: NIST National Vulnerability Database (record CVE-2026-33762), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.