CVE-2025-21614

What it actually does

Improper input validation in go-git clients allows a remote Git server to return specially crafted responses that trigger unbounded resource allocation, leading to exhaustion of memory or CPU on the client.

Why it matters to the business

Applications and tools that embed go-git to fetch or interact with remote repositories can be forced offline or slowed to unusability when connecting to an attacker-controlled or compromised Git server, disrupting CI/CD pipelines, dependency updates, and automated code operations.

How an attack unfolds

An attacker hosts or compromises a Git server and returns malicious protocol responses; a go-git client connecting to fetch or clone triggers excessive memory or CPU consumption until the process crashes or becomes unresponsive.

How to fix it

Upgrade go-git to the version containing commit 94bd4af1deb15a64e90c6287eaf9e9f09b192a1f or later; rebuild and redeploy all dependent binaries; verify no pinned older versions remain in vendor directories or container images.

How to confirm the fix worked

Confirm the go-git module version in go.mod or binary build info matches or exceeds the fixed commit; run integration tests against a server returning known malicious responses to verify resource usage remains bounded.

Typical attack path

1. Attacker positions a malicious Git server reachable by the target client
2. Target application initiates a fetch, clone, or other remote operation using go-git
3. Server returns crafted responses that exploit validation gaps
4. Client allocates excessive resources leading to denial of service

How to detect it

Review application logs for sudden spikes in memory or CPU usage correlated with Git client activity; inspect outbound connections to Git servers for unexpected hosts or unusual response sizes; examine process dumps or traces showing excessive allocation during remote operations.

What your security team should do

• Immediately update all go-git usages to the fixed commit and rebuild affected services
• Inventory Go-based tools and CI runners that perform Git operations over the network
• Add dependency scanning rules to block future builds with versions prior to the fix
• Monitor for anomalous memory or CPU spikes during Git client operations