CVE-2026-34165: falha de média gravidade em go-git
go-git: Maliciously crafted idx file can cause asymmetric memory consumption
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5epss 0.2%
go-git is an extensible git implementation library written in pure Go. From version 5.0.0 to before version 5.17.1, a vulnerability has been identified in which a maliciously crafted .idx file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a denial-of-service (DoS) condition. Exploitation requires write access to the local repository's .git directory, it order to create or alter existing .idx files. This issue has been patched in version 5.17.1.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Produtos afetados
go-git · go-gitCVEs relacionadas — go-git
No mesmo produto, das mais perigosas para as menos.
CVE-2023-49569CRITICALMaliciously crafted Git server replies can lead to path traversal and RCE on go-git clientsEPSS 1.5%CVE-2025-21613CRITICALgo-git has an Argument Injection via the URL fieldEPSS 1.3%CVE-2025-21614HIGHgo-git clients vulnerable to DoS via maliciously crafted Git server repliesEPSS 0.7%CVE-2023-49568HIGHMaliciously crafted Git server replies can cause DoS on go-git clientsEPSS 0.7%CVE-2026-71557MEDIUMgo-git: Malicious reference names may modify files outside the reference storageEPSS 0.4%CVE-2026-45570LOWgo-git: Improper single-quote escaping in go-git SSH transportEPSS 0.4%