CVE-2026-33762 Details
Description
go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing. This issue only affects Git index format version 4. Earlier formats (go-git supports only v2 and v3) are not vulnerable to this issue. This issue has been patched in version 5.17.1.
A vulnerability exists in go-git's index decoder for Git index format version 4, prior to version 5.17.1. The decoder fails to properly validate the path name prefix length before applying it to the previously decoded path name. This oversight can be exploited by a maliciously crafted index file, leading to an out-of-bounds slice operation. As a result, a runtime panic occurs during normal index parsing. This vulnerability only affects Git index format version 4; earlier formats, such as versions 2 and 3, are not vulnerable.
Users should upgrade to go-git version 5.17.1 or the latest v6 pseudo-version to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-git/go-git/releases/tag/v5.17.1 | [email protected] | ProductRelease Notes |
| https://github.com/go-git/go-git/security/advisories/GHSA-gm2x-2g9h-ccm8 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-129 | Improper Validation of Array Index | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| go-git project go-git | < 5.17.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 2, 2026 | Initial Analysis | [email protected] |
| Mar 31, 2026 | New CVE Received | [email protected] |