Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-09 | 1 | Disclosure1 |
| 2026-02-10 | 2 | Disclosure2 |
| 2026-04-17 | 1 | Patch1 |
CVE-2026-25934 Go-Git Packfile and Index File Integrity Verification Vulnerability Before 5.16.5 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25934
Post summary
A new Go‑Git vulnerability (CVE‑2026‑25934) affecting versions before 5.16.5 was identified, but no PoC, exploit, or patch information is provided.
BREAKING: openSUSE Leap 15.6 and Ubuntu Server 22.04 patch critical Terraform provider flaws CVE-2026-25934 and CVE-2026-33186, with HTTP/2 :path bug rated CVSS 9.1 and PoC released 2026-04-07. https://threatcluster.io/cluster/critical-vulnerabilities-in-terraform-providers-affecting-op-588dd59e
Post summary
OpenSUSE Leap 15.6 and Ubuntu Server 22.04 have released critical patches for Terraform provider CVEs 2026-25934 and 2026-33186, with a public PoC and a CVSS 9.1 rating for an HTTP/2 :path flaw.
CVE-2026-25934: Broken Seals: How go-git Forgot to Check the Receipt (CVE-2026-25934) A fundamental data integrity flaw in the popular `go-git` library allowed for the consumption of corrupted or malicious Git packfiles without detection. By failing t... https://cvereports.com/reports/CVE-2026-25934
Post summary
The report exposes a data integrity issue in the go‑git library enabling processing of malicious packfiles, without providing PoC, exploit code, or mitigation information.
CVE-2026-25934 go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values f… https://www.cve.org/CVERecord?id=CVE-2026-25934
Post summary
CVE‑2026‑25934 is a data‑integrity issue in go‑git before version 5.16.5, but no PoC, exploit, patch, or active exploitation details are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | go-git_project | go-git | - | go | - |