CVE-2023-49568

What it actually does

Crafted Git server responses trigger unbounded resource consumption (CPU/memory) in go-git clients during repository operations when using on-disk storage.

Why it matters to the business

Applications relying on go-git for repository access can be rendered unavailable by an attacker controlling or intercepting responses from a Git server, leading to operational disruption and potential downtime for dependent services.

How an attack unfolds

An attacker positions themselves as a malicious or compromised Git server and returns specially crafted protocol responses that cause the client to allocate excessive resources until exhaustion occurs.

How to fix it

Upgrade go-git to the fixed commit 5d08d3bd94c65a3b6c25c6fba6907d12b0dac4ca (equivalent to v5.11 or later) in all affected packages and rebuild dependent applications. Applications limited to in-memory filesystems require no change.

How to confirm the fix worked

Confirm go-git version is at or above the fixed commit via dependency manifests or build outputs; test connectivity to untrusted Git servers while monitoring resource usage for exhaustion.

Typical attack path

1. Identify applications or services using vulnerable go-git versions for remote Git operations
2. Compromise or impersonate a Git server reachable by the target client
3. Serve malicious responses during clone, fetch, or related operations
4. Trigger repeated resource exhaustion leading to denial of service

How to detect it

Review application and system logs for sudden spikes in memory or CPU usage during Git operations; inspect process trees for go-git clients connected to external repositories around the time of resource exhaustion events.

What your security team should do

• Prioritize upgrade of go-git across all projects given the public disclosure and network-reachable attack vector
• Inventory applications using on-disk go-git storage and schedule patching before external repository interactions
• Monitor dependency update pipelines for go-git and enforce version pinning to the fixed release