CVE-2023-49568highCWE-20

CVE-2023-49568: falha de alta gravidade em go-git

Maliciously crafted Git server replies can cause DoS on go-git clients

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar go-git+ Monitorar golang-github-go-git-go-git

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.7%
A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Applications using only the in-memory filesystem supported by go-git are not affected by this vulnerability. This is a go-git implementation issue and does not affect the upstream git cli.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
go-git · go-git
CVEs relacionadas — go-git

No mesmo produto, das mais perigosas para as menos.

CVE-2023-49569CRITICALMaliciously crafted Git server replies can lead to path traversal and RCE on go-git clientsEPSS 1.5%CVE-2025-21613CRITICALgo-git has an Argument Injection via the URL fieldEPSS 1.3%CVE-2025-21614HIGHgo-git clients vulnerable to DoS via maliciously crafted Git server repliesEPSS 0.7%CVE-2026-71557MEDIUMgo-git: Malicious reference names may modify files outside the reference storageEPSS 0.4%CVE-2026-45570LOWgo-git: Improper single-quote escaping in go-git SSH transportEPSS 0.4%CVE-2026-71556HIGHgo-git: Worktree operations may follow symlinksEPSS 0.4%