CVE-2026-25934
Medium · 4.3CVSS
4.3
EPSS
0.2%
Published
Feb 9, 2026
CISA due date
—
The record
go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/go-git/go-git | 0 | No fix |
| Go | github.com/go-git/go-git/v4 | 0 | No fix |
| Go | github.com/go-git/go-git/v5 | 0 | 5.16.5 |
| Chainguard | amazon-ssm-agent | 0 | 3.3.3270.0-r5 |
| Chainguard | amazon-ssm-agent-ecs-exec | 0 | 3.3.3270.0-r5 |
| Chainguard | amazon-ssm-agent-ecs-exec-fips | 0 | 3.3.3270.0-r6 |
| Chainguard | amazon-ssm-agent-fips | 0 | 3.3.3270.0-r6 |
| Chainguard | apko | 0 | 1.1.6-r1 |
| Chainguard | apko-fips | 0 | 1.1.6-r1 |
| Chainguard | argo-cd-2.13 | 0 | 2.13.9-r8 |
| Chainguard | argo-cd-2.13-compat | 0 | 2.13.9-r8 |
| Chainguard | argo-cd-2.14 | 0 | 2.14.21-r8 |
| Chainguard | argo-cd-2.14-compat | 0 | 2.14.21-r8 |
| Chainguard | argo-cd-3.0 | 0 | 3.0.23-r2 |
| Chainguard | argo-cd-3.0-compat | 0 | 3.0.23-r2 |
| Chainguard | argo-cd-3.1 | 0 | 3.1.12-r3 |
| Chainguard | argo-cd-3.1-compat | 0 | 3.1.12-r3 |
| Chainguard | argo-cd-3.2 | 0 | 3.2.6-r3 |
| Chainguard | argo-cd-3.2-compat | 0 | 3.2.6-r3 |
| Chainguard | argo-cd-fips-3.0 | 0 | 3.0.23-r2 |
| Chainguard | argo-cd-fips-3.0-compat | 0 | 3.0.23-r2 |
| Chainguard | argo-cd-fips-3.1 | 0 | 3.1.12-r2 |
| Chainguard | argo-cd-fips-3.1-compat | 0 | 3.1.12-r2 |
| Chainguard | argo-cd-fips-3.2 | 0 | 3.2.6-r3 |
| Chainguard | argo-cd-fips-3.2-compat | 0 | 3.2.6-r3 |
| Chainguard | argo-events | 0 | 1.9.10-r3 |
| Chainguard | argo-events-fips | 0 | 1.9.10-r2 |
| Chainguard | argo-workflow-executor-3.6 | 0 | 3.6.19-r1 |
| Chainguard | argo-workflow-executor-3.7 | 0 | 3.7.10-r0 |
| Chainguard | argo-workflow-executor-fips-3.6 | 0 | 3.6.18-r3 |
| Chainguard | argo-workflow-executor-fips-3.7 | 0 | 3.7.10-r0 |
| Chainguard | argo-workflows-3.6 | 0 | 3.6.19-r1 |
| Chainguard | argo-workflows-3.7 | 0 | 3.7.10-r0 |
| Chainguard | argo-workflows-fips-3.6 | 0 | 3.6.18-r3 |
| Chainguard | argo-workflows-fips-3.7 | 0 | 3.7.10-r0 |
| Chainguard | argocd-image-updater | 0 | 1.1.0-r1 |
| Chainguard | argocd-image-updater-fips | 0 | 1.1.0-r2 |
| Chainguard | bom | 0 | 0.7.1-r6 |
| Chainguard | cerbos | 0 | 0.51.0-r2 |
| Chainguard | cerbos-fips | 0 | 0.51.0-r1 |
| Chainguard | cerbosctl | 0 | 0.51.0-r2 |
| Chainguard | cerbosctl-fips | 0 | 0.51.0-r1 |
| Chainguard | cg | 0 | 0.2.203-r0 |
| Chainguard | chainctl | 0 | 0.2.206-r0 |
| Chainguard | chezmoi | 0 | 2.69.3-r2 |
| Chainguard | cloudbeat-8.17 | 0 | 8.17.10-r7 |
| Chainguard | cloudbeat-8.18 | 0 | 8.18.8-r8 |
| Chainguard | cloudbeat-8.19 | 0 | 8.19.11-r1 |
| Chainguard | cloudbeat-9.0 | 0 | 9.0.8-r7 |
| Chainguard | cloudbeat-9.1 | 0 | 9.1.10-r2 |
| Chainguard | cloudbeat-9.2 | 0 | 9.2.5-r2 |
| Chainguard | cloudbeat-fips-8.17 | 0 | 8.17.10-r9 |
| Chainguard | cloudbeat-fips-8.18 | 0 | 8.18.8-r8 |
| Chainguard | cloudbeat-fips-8.19 | 0 | 8.19.11-r1 |
| Chainguard | cloudbeat-fips-9.0 | 0 | 9.0.8-r7 |
| Chainguard | cloudbeat-fips-9.1 | 0 | 9.1.10-r2 |
| Chainguard | cloudbeat-fips-9.2 | 0 | 9.2.5-r2 |
| Chainguard | crossplane-1.20-crank | 0 | 1.20.5-r2 |
| Chainguard | crossplane-2.0-crank | 0 | 2.0.7-r2 |
| Chainguard | crossplane-2.1-crank | 0 | 2.1.4-r2 |
| Chainguard | crossplane-fips-1.20-crank | 0 | 1.20.5-r2 |
| Chainguard | crossplane-fips-2.0-crank | 0 | 2.0.7-r2 |
| Chainguard | crossplane-fips-2.1-crank | 0 | 2.1.4-r2 |
| Chainguard | crossplane-fips-2.2-crank | 0 | 2.2.0-r1 |
| Chainguard | dagger | 0 | 0.19.11-r1 |
| Chainguard | external-secrets-operator-1.3 | 0 | 1.3.2-r1 |
| Chainguard | flux-2.5 | 0 | 2.5.1-r20 |
| Chainguard | flux-2.6 | 0 | 2.6.4-r12 |
| Chainguard | flux-2.7 | 0 | 2.7.5-r6 |
| Chainguard | flux-fips-2.5 | 0 | 2.5.1-r17 |
| Chainguard | flux-fips-2.6 | 0 | 2.6.4-r11 |
| Chainguard | flux-fips-2.7 | 0 | 2.7.5-r5 |
| Chainguard | flux-image-automation-controller | 0 | 1.0.4-r6 |
| Chainguard | flux-image-automation-controller-fips | 0 | 1.0.4-r6 |
| Chainguard | flux-kustomize-controller | 0 | 1.7.3-r6 |
| Chainguard | flux-kustomize-controller-fips | 0 | 1.7.3-r4 |
| Chainguard | flux-operator | 0 | 0.41.0-r0 |
| Chainguard | flux-source-controller | 0 | 1.7.4-r8 |
| Chainguard | flux-source-controller-fips | 0 | 1.7.4-r7 |
| Chainguard | flux-source-watcher | 0 | 2.0.3-r4 |
| Chainguard | flux-source-watcher-fips | 0 | 2.0.3-r3 |
| Chainguard | gitaly-18.6 | 0 | 18.6.6-r1 |
| Chainguard | gitaly-18.7 | 0 | 18.7.4-r1 |
| Chainguard | gitaly-18.8 | 0 | 18.8.4-r1 |
| Chainguard | gitaly-fips-18.6 | 0 | 18.6.5-r1 |
| Chainguard | gitaly-fips-18.7 | 0 | 18.7.4-r1 |
| Chainguard | gitaly-fips-18.8 | 0 | 18.8.4-r2 |
| Chainguard | gitea | 0 | 1.25.4-r2 |
| Chainguard | gitea-fips | 0 | 1.25.4-r1 |
| Chainguard | gitlab-rails-ce-18.6 | 0 | 18.6.6-r2 |
| Chainguard | gitlab-rails-ce-18.7 | 0 | 18.7.4-r2 |
| Chainguard | gitlab-rails-ce-18.8 | 0 | 18.8.4-r1 |
| Chainguard | gitlab-rails-ce-fips-18.6 | 0 | 18.6.6-r1 |
| Chainguard | gitlab-rails-ce-fips-18.7 | 0 | 18.7.4-r1 |
| Chainguard | gitlab-rails-ce-fips-18.8 | 0 | 18.8.4-r1 |
| Chainguard | gitlab-runner-18.6 | 0 | 18.6.6-r2 |
| Chainguard | gitlab-runner-18.7 | 0 | 18.7.2-r3 |
| Chainguard | gitlab-runner-18.8 | 0 | 18.8.0-r1 |
| Chainguard | gitlab-runner-fips-18.6 | 0 | 18.6.6-r3 |
| Chainguard | gitlab-runner-fips-18.7 | 0 | 18.7.2-r4 |
| Chainguard | gitlab-runner-fips-18.8 | 0 | 18.8.0-r2 |
| Chainguard | gitlab-runner-helper-18.6 | 0 | 18.6.6-r2 |
| Chainguard | gitlab-runner-helper-18.7 | 0 | 18.7.2-r3 |
| Chainguard | gitlab-runner-helper-18.8 | 0 | 18.8.0-r1 |
| Chainguard | gitlab-runner-helper-fips-18.6 | 0 | 18.6.6-r3 |
| Chainguard | gitlab-runner-helper-fips-18.7 | 0 | 18.7.2-r4 |
| Chainguard | gitlab-runner-helper-fips-18.8 | 0 | 18.8.0-r2 |
| Chainguard | gitsign | 0 | 0.14.0-r3 |
| Chainguard | gomplate | 0 | 5.0.0-r3 |
| Chainguard | gomplate-fips | 0 | 5.0.0-r2 |
| Chainguard | google-osconfig-agent | 0 | 20251028.00-r6 |
| Chainguard | goreleaser | 0 | 2.14.0-r0 |
| Chainguard | gptscript | 0 | 0.9.8-r4 |
| Chainguard | grafana-12.1 | 0 | 12.1.8-r1 |
| Chainguard | grafana-alloy | 0 | 1.13.1-r0 |
| Chainguard | grafana-alloy-fips | 0 | 1.13.1-r0 |
| Chainguard | grafana-fips-12.1 | 0 | 12.1.7-r1 |
| Chainguard | grype | 0 | 0.108.0-r0 |
| Chainguard | grype-db | 0 | 0.51.0-r1 |
| Chainguard | grype-fips | 0 | 0.108.0-r0 |
| Chainguard | guac | 0 | 1.0.1-r6 |
| Chainguard | guacingest | 0 | 1.0.1-r6 |
| Chainguard | guacone | 0 | 1.0.1-r6 |
| Chainguard | k9s | 0 | 0.50.18-r3 |
| Chainguard | k9s-fips | 0 | 0.50.18-r3 |
| Chainguard | kargo | 0 | 1.9.3-r1 |
| Chainguard | kots | 0 | 1.129.3-r2 |
| Chainguard | kubescape | 0 | 4.0.0-r1 |
| Chainguard | kubevela-vela-cli | 0 | 1.10.6-r3 |
| Chainguard | kubevela-vela-cli-fips | 0 | 1.10.6-r2 |
| Chainguard | kubevela-vela-core | 0 | 1.10.6-r3 |
| Chainguard | kubevela-vela-core-fips | 0 | 1.10.6-r2 |
| Chainguard | kyverno-cli-1.14 | 0 | 1.14.5-r7 |
| Chainguard | kyverno-cli-1.15 | 0 | 1.15.3-r2 |
| Chainguard | kyverno-cli-1.16 | 0 | 1.16.3-r4 |
| Chainguard | kyverno-cli-fips-1.14 | 0 | 1.14.5-r7 |
| Chainguard | kyverno-cli-fips-1.15 | 0 | 1.15.3-r2 |
| Chainguard | kyverno-cli-fips-1.16 | 0 | 1.16.3-r4 |
| Chainguard | livekit-cli | 0 | 2.13.2-r1 |
| Chainguard | melange | 0 | 0.41.1-r1 |
| Chainguard | nemo | 0 | 2.6.2-r2 |
| Chainguard | nfpm | 0 | 2.45.0-r2 |
| Chainguard | nuclei | 0 | 3.7.0-r2 |
| Chainguard | osv-scanner | 0 | 2.3.2-r4 |
| Chainguard | packer | 0 | 1.15.0-r1 |
| Chainguard | packer-fips | 0 | 1.15.0-r2 |
| Chainguard | pulumi | 0 | 3.220.0-r0 |
| Chainguard | pulumi-kubernetes-operator | 0 | 1.16.0-r26 |
| Chainguard | pulumi-language-dotnet | 0 | 3.101.0-r0 |
| Chainguard | pulumi-language-go | 0 | 3.220.0-r0 |
| Chainguard | pulumi-language-java | 0 | 1.21.0-r2 |
| Chainguard | pulumi-language-nodejs | 0 | 3.220.0-r0 |
| Chainguard | pulumi-language-python | 0 | 3.220.0-r0 |
| Chainguard | rancher-fleet-cli | 0 | 0.14.2-r3 |
| Chainguard | rancher-fleet-cli-fips | 0 | 0.14.2-r2 |
| Chainguard | rancher-fleet-controller | 0 | 0.14.2-r3 |
| Chainguard | rancher-fleet-controller-fips | 0 | 0.14.2-r2 |
| Chainguard | scorecard | 0 | 5.4.0-r6 |
| Chainguard | skaffold | 0 | 2.17.1-r6 |
| Chainguard | skaffold-fips | 0 | 2.17.1-r3 |
| Chainguard | snyk-cli | 0 | 1.1302.1-r3 |
| Chainguard | src-fingerprint | 0 | 0.19.0-r39 |
| Chainguard | src-fingerprint-fips | 0 | 0.19.0-r25 |
| Chainguard | steampipe | 0 | 2.3.5-r1 |
| Chainguard | syft | 0 | 1.42.0-r0 |
| Chainguard | syft-fips | 0 | 1.42.0-r0 |
| Chainguard | tekton-pipelines-resolvers-0.59 | 0 | 0.59.6-r14 |
| Chainguard | tekton-pipelines-resolvers-0.62 | 0 | 0.62.9-r14 |
| Chainguard | tekton-pipelines-resolvers-0.65 | 0 | 0.65.7-r13 |
| Chainguard | tekton-pipelines-resolvers-0.68 | 0 | 0.68.1-r11 |
| Chainguard | tekton-pipelines-resolvers-fips-0.59 | 0 | 0.59.6-r14 |
| Chainguard | tekton-pipelines-resolvers-fips-0.62 | 0 | 0.62.9-r14 |
| Chainguard | tekton-pipelines-resolvers-fips-0.65 | 0 | 0.65.7-r14 |
| Chainguard | tekton-pipelines-resolvers-fips-0.68 | 0 | 0.68.1-r13 |
| Chainguard | teleport-17 | 0 | 17.7.19-r1 |
| Chainguard | teleport-18 | 0 | 18.6.7-r1 |
| Chainguard | teleport-18.6 | 0 | 18.6.8-r4 |
| Chainguard | tfsec | 0 | 1.28.14-r12 |
| Chainguard | timoni | 0 | 0.25.2-r6 |
| Chainguard | trivy | 0 | 0.69.1-r1 |
| Chainguard | trivy-fips | 0 | 0.69.1-r1 |
| Chainguard | trivy-operator | 0 | 0.29.0-r10 |
| Chainguard | trivy-operator-fips | 0 | 0.29.0-r10 |
| Chainguard | trufflehog | 0 | 3.93.2-r1 |
| Chainguard | trufflehog-fips | 0 | 3.93.1-r1 |
| Chainguard | witness | 0 | 0.10.2-r6 |
| Chainguard | wolfictl | 0 | 0.39.0-r3 |
| Chainguard | xeol | 0 | 0.10.8-r23 |
| Chainguard | xeol-fips | 0 | 0.10.8-r22 |
| Chainguard | zarf | 0 | 0.71.1-r1 |
| Chainguard | zot | 0 | 2.1.14-r3 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-local | 0 | 2.0.0-150200.6.8.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-null | 0 | 3.0.0-150200.6.12.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-random | 0 | 3.0.0-150200.6.6.2 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-tls | 0 | 3.0.0-150200.5.6.2 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-local | 0 | 2.0.0-150200.6.8.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-null | 0 | 3.0.0-150200.6.12.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-random | 0 | 3.0.0-150200.6.6.2 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-tls | 0 | 3.0.0-150200.5.6.2 |
| Wolfi | apko | 0 | 1.1.6-r1 |
Related vulnerabilities
- CVE-2025-21614 go-git clients vulnerable to DoS via maliciously crafted Git server replies Also affects github.com/go-git/go-git
- CVE-2025-21613 go-git has an Argument Injection via the URL field Also affects github.com/go-git/go-git/v4
- CVE-2023-49569 A path traversal vulnerability was discovered in go-git versions prior to v5.11. Also affects github.com/go-git/go-git/v4
- CVE-2023-49568 A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. Also affects github.com/go-git/go-git/v5
- CVE-2026-34986 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of… Also affects amazon-ssm-agent
- CVE-2026-34165 go-git is an extensible git implementation library written in pure Go. Also affects amazon-ssm-agent
- CVE-2026-33762 go-git is an extensible git implementation library written in pure Go. Also affects amazon-ssm-agent
- CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Also affects amazon-ssm-agent