CVE-2026-33762
LOW
INFO
Priority: 0.01
BB Relevance:
21/100
Published: 2026-03-31
Modified: 2026-11-02
First seen: 2026-11-02
Status: active
Attack Surface
Low Complexity
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
Required
S:
Unchanged
C:
None
I:
None
A:
Low
Description
go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing. This issue only affects Git index format version 4. Earlier formats (go-git supports only v2 and v3) are not vulnerable to this issue. This issue has been patched in version 5.17.1.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| go-git | go-git | < 5.17.1 |
| go-git_project | go-git | < 5.17.1 |
References & Advisories (3)
x_refsource_MISC
x_refsource_MISC
x_refsource_CONFIRM