Fluid Attacks Database

Description

Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
go	github.com/go-git/go-git/v5	>=5.0.0 <5.17.1	5.17.1
debian 13	golang-github-go-git-go-git	=5.14.0-1 \|\| =5.16.2-1 \|\| =5.17.0-1 \|\| =5.17.1-1	-
debian 12	golang-github-go-git-go-git	=5.11.0-1 \|\| =5.11.0-2 \|\| =5.11.0-3 \|\| =5.11.0-4 \|\| =5.12.0-1 \|\| =5.13.2-1 \|\| =5.14.0-1 \|\| =5.16.2-1 \|\| =5.17.0-1 \|\| =5.17.1-1 \|\| =5.4.2-3 \|\| =5.4.2-4	-
go	github.com/go-git/go-git	-	-
debian 14	golang-github-go-git-go-git	=5.14.0-1 \|\| =5.16.2-1 \|\| =5.17.0-1 \|\| >=0 <5.17.1-1	5.17.1-1
rpm rhel9	grafana	-	-
rpm rhel8	grafana	-	-
go	github.com/go-git/go-git/v4	-	-

Aliases

1. CVE-2026-341652. NVD-2026-341653. OSV-2026-341654. OSV-DEBIAN-2026-341655. OSV-GO-2026-49106. GHSA-jhf3-xxhw-2wpp7. GCVE-2026-341658. SECURITY-TRACKER-CVE-2026-341659. GHSA-jhf3-xxhw-2wpp

References

1. https://github.com/go-git/go-git/security/advisories/GHSA-jhf3-xxhw-2wpp2. https://github.com/go-git/go-git/releases/tag/v5.17.1

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.