CVE-2026-33762
Low · 2.8CVSS
2.8
EPSS
0.2%
Published
Mar 31, 2026
CISA due date
—
The record
go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing. This issue only affects Git index format version 4. Earlier formats (go-git supports only v2 and v3) are not vulnerable to this issue. This issue has been patched in version 5.17.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | amazon-ssm-agent | 0 | 3.3.3270.0-r10 |
| Chainguard | amazon-ssm-agent-ecs-exec | 0 | 3.3.3270.0-r10 |
| Chainguard | amazon-ssm-agent-ecs-exec-fips | 0 | 3.3.3270.0-r11 |
| Chainguard | amazon-ssm-agent-fips | 0 | 3.3.3270.0-r11 |
| Chainguard | apko | 0 | 1.2.0-r1 |
| Chainguard | apko-fips | 0 | 1.2.1-r0 |
| Chainguard | argo-cd-3.1 | 0 | 3.1.13-r1 |
| Chainguard | argo-cd-3.1-compat | 0 | 3.1.13-r1 |
| Chainguard | argo-cd-3.2 | 0 | 3.2.8-r1 |
| Chainguard | argo-cd-3.2-compat | 0 | 3.2.8-r1 |
| Chainguard | argo-cd-3.3 | 0 | 3.3.6-r2 |
| Chainguard | argo-cd-3.3-compat | 0 | 3.3.6-r2 |
| Chainguard | argo-cd-fips-3.1 | 0 | 3.1.13-r1 |
| Chainguard | argo-cd-fips-3.1-compat | 0 | 3.1.13-r1 |
| Chainguard | argo-cd-fips-3.2 | 0 | 3.2.8-r1 |
| Chainguard | argo-cd-fips-3.2-compat | 0 | 3.2.8-r1 |
| Chainguard | argo-cd-fips-3.3 | 0 | 3.3.5-r1 |
| Chainguard | argo-cd-fips-3.3-compat | 0 | 3.3.5-r1 |
| Chainguard | argo-events | 0 | 1.9.10-r14 |
| Chainguard | argo-workflow-executor-3.7 | 0 | 3.7.12-r2 |
| Chainguard | argo-workflow-executor-4.0 | 0 | 4.0.3-r2 |
| Chainguard | argo-workflow-executor-fips-3.7 | 0 | 3.7.12-r2 |
| Chainguard | argo-workflow-executor-fips-4.0 | 0 | 4.0.3-r2 |
| Chainguard | argo-workflows-3.7 | 0 | 3.7.12-r2 |
| Chainguard | argo-workflows-4.0 | 0 | 4.0.3-r2 |
| Chainguard | argo-workflows-fips-4.0 | 0 | 4.0.3-r2 |
| Chainguard | argocd-image-updater | 0 | 1.1.1-r5 |
| Chainguard | argocd-image-updater-fips | 0 | 1.1.1-r6 |
| Chainguard | bom | 0 | 0.7.1-r11 |
| Chainguard | cerbos | 0 | 0.51.0-r10 |
| Chainguard | cerbos-fips | 0 | 0.51.0-r7 |
| Chainguard | cerbosctl | 0 | 0.51.0-r10 |
| Chainguard | cerbosctl-fips | 0 | 0.51.0-r7 |
| Chainguard | cg | 0 | 0.2.232-r0 |
| Chainguard | chezmoi | 0 | 2.70.0-r1 |
| Chainguard | cloudbeat-8.19 | 0 | 8.19.13-r3 |
| Chainguard | cloudbeat-9.2 | 0 | 9.2.7-r3 |
| Chainguard | cloudbeat-9.3 | 0 | 9.3.2-r2 |
| Chainguard | cloudbeat-fips-8.19 | 0 | 8.19.13-r2 |
| Chainguard | cloudbeat-fips-9.3 | 0 | 9.3.2-r3 |
| Chainguard | crossplane-1.20-crank | 0 | 1.20.5-r8 |
| Chainguard | crossplane-2.0-crank | 0 | 2.0.7-r7 |
| Chainguard | crossplane-2.1-crank | 0 | 2.1.4-r8 |
| Chainguard | crossplane-2.2-crank | 0 | 2.2.0-r5 |
| Chainguard | crossplane-fips-1.20-crank | 0 | 1.20.5-r9 |
| Chainguard | crossplane-fips-2.0-crank | 0 | 2.0.7-r9 |
| Chainguard | crossplane-fips-2.1-crank | 0 | 2.1.4-r9 |
| Chainguard | crossplane-fips-2.2-crank | 0 | 2.2.0-r7 |
| Chainguard | dagger | 0 | 0.20.3-r1 |
| Chainguard | external-secrets-operator-2.2 | 0 | 2.2.0-r1 |
| Chainguard | external-secrets-operator-fips-2.2 | 0 | 2.2.0-r1 |
| Chainguard | flux-2.6 | 0 | 2.6.4-r16 |
| Chainguard | flux-2.7 | 0 | 2.7.5-r11 |
| Chainguard | flux-2.8 | 0 | 2.8.3-r3 |
| Chainguard | flux-fips-2.6 | 0 | 2.6.4-r16 |
| Chainguard | flux-fips-2.7 | 0 | 2.7.5-r10 |
| Chainguard | flux-image-automation-controller | 0 | 1.1.1-r9 |
| Chainguard | flux-image-automation-controller-fips | 0 | 1.1.1-r2 |
| Chainguard | flux-source-controller | 0 | 1.8.1-r3 |
| Chainguard | flux-source-controller-fips | 0 | 1.8.1-r2 |
| Chainguard | gitaly-18.10 | 0 | 18.10.2-r1 |
| Chainguard | gitaly-18.8 | 0 | 18.8.8-r1 |
| Chainguard | gitaly-18.9 | 0 | 18.9.4-r1 |
| Chainguard | gitea | 0 | 1.25.5-r3 |
| Chainguard | gitea-fips | 0 | 1.25.5-r2 |
| Chainguard | gitlab-runner-18.7 | 0 | 18.7.2-r10 |
| Chainguard | gitlab-runner-helper-18.7 | 0 | 18.7.2-r10 |
| Chainguard | gitsign | 0 | 0.14.0-r12 |
| Chainguard | gomplate-4 | 0 | 4.3.3-r6 |
| Chainguard | gomplate-5 | 0 | 5.0.0-r13 |
| Chainguard | gomplate-fips-4 | 0 | 4.3.3-r7 |
| Chainguard | gomplate-fips-5 | 0 | 5.0.0-r12 |
| Chainguard | google-osconfig-agent | 0 | 20251028.00-r12 |
| Chainguard | grafana-alloy | 0 | 1.15.0-r2 |
| Chainguard | grafana-alloy-fips | 0 | 1.15.0-r2 |
| Chainguard | grype | 0 | 0.110.0-r1 |
| Chainguard | grype-db | 0 | 0.53.0-r4 |
| Chainguard | grype-fips | 0 | 0.110.0-r1 |
| Chainguard | jfrog-cli | 0 | 2.97.0-r1 |
| Chainguard | k9s | 0 | 0.50.18-r13 |
| Chainguard | k9s-fips | 0 | 0.50.18-r12 |
| Chainguard | kargo | 0 | 1.9.5-r7 |
| Chainguard | kots | 0 | 1.129.4-r5 |
| Chainguard | kubevela-vela-cli | 0 | 1.10.7-r6 |
| Chainguard | kubevela-vela-cli-fips | 0 | 1.10.7-r7 |
| Chainguard | kubevela-vela-core | 0 | 1.10.7-r6 |
| Chainguard | kubevela-vela-core-fips | 0 | 1.10.7-r7 |
| Chainguard | kyverno-cli-1.15 | 0 | 1.15.3-r8 |
| Chainguard | kyverno-cli-1.16 | 0 | 1.16.3-r11 |
| Chainguard | kyverno-cli-1.17 | 0 | 1.17.1-r8 |
| Chainguard | kyverno-cli-fips-1.15 | 0 | 1.15.3-r8 |
| Chainguard | kyverno-cli-fips-1.16 | 0 | 1.16.3-r11 |
| Chainguard | kyverno-cli-fips-1.17 | 0 | 1.17.1-r8 |
| Chainguard | livekit-cli | 0 | 2.16.0-r5 |
| Chainguard | melange | 0 | 0.48.0-r0 |
| Chainguard | nfpm | 0 | 2.45.2-r4 |
| Chainguard | nuclei | 0 | 3.7.1-r5 |
| Chainguard | packer | 0 | 1.15.1-r1 |
| Chainguard | packer-fips | 0 | 1.15.1-r1 |
| Chainguard | pulumi | 0 | 3.229.0-r2 |
| Chainguard | pulumi-kubernetes-operator | 0 | 2.6.0-r1 |
| Chainguard | pulumi-language-dotnet | 0 | 3.102.0-r3 |
| Chainguard | pulumi-language-go | 0 | 3.229.0-r2 |
| Chainguard | pulumi-language-java | 0 | 1.21.3-r4 |
| Chainguard | pulumi-language-nodejs | 0 | 3.229.0-r2 |
| Chainguard | pulumi-language-python | 0 | 3.229.0-r2 |
| Chainguard | pulumi-language-yaml | 0 | 1.30.1-r3 |
| Chainguard | rancher-fleet-cli | 0 | 0.15.0-r1 |
| Chainguard | rancher-fleet-cli-fips | 0 | 0.15.0-r1 |
| Chainguard | rancher-fleet-controller-fips | 0 | 0.15.0-r1 |
| Chainguard | skaffold | 0 | 2.18.2-r2 |
| Chainguard | skaffold-fips | 0 | 2.18.2-r1 |
| Chainguard | snyk-cli | 0 | 1.1303.2-r1 |
| Chainguard | syft | 0 | 1.42.3-r1 |
| Chainguard | syft-fips | 0 | 1.42.3-r1 |
| Chainguard | teleport-17 | 0 | 17.7.20-r5 |
| Chainguard | teleport-18 | 0 | 18.7.2-r6 |
| Chainguard | teleport-18.6 | 0 | 18.6.8-r9 |
| Chainguard | tfsec | 0 | 1.28.14-r24 |
| Chainguard | trivy | 0 | 0.69.3-r6 |
| Chainguard | trivy-fips | 0 | 0.69.3-r4 |
| Chainguard | trivy-operator | 0 | 0.30.1-r4 |
| Chainguard | trivy-operator-fips | 0 | 0.30.1-r3 |
| Chainguard | trufflehog | 0 | 3.94.1-r1 |
| Chainguard | trufflehog-fips | 0 | 3.94.2-r1 |
| Chainguard | witness | 0 | 0.10.2-r16 |
| Chainguard | wolfictl | 0 | 0.39.7-r1 |
| Chainguard | xeol | 0 | 0.10.8-r30 |
| Chainguard | xeol-fips | 0 | 0.10.8-r29 |
| Chainguard | zarf | 0 | 0.74.0-r2 |
| Chainguard | zarf-fips | 0 | 0.74.1-r0 |
| Chainguard | zot | 0 | 2.1.15-r6 |
| Wolfi | apko | 0 | 1.2.0-r1 |
| Wolfi | argo-cd-3.1 | 0 | 3.1.13-r1 |
| Wolfi | argo-cd-3.1-compat | 0 | 3.1.13-r1 |
| Wolfi | argo-cd-3.2 | 0 | 3.2.8-r1 |
| Wolfi | argo-cd-3.2-compat | 0 | 3.2.8-r1 |
| Wolfi | argo-cd-3.3 | 0 | 3.3.6-r2 |
| Wolfi | argo-cd-3.3-compat | 0 | 3.3.6-r2 |
| Wolfi | argo-events | 0 | 1.9.10-r14 |
| Wolfi | argo-workflow-executor-3.7 | 0 | 3.7.12-r2 |
| Wolfi | argo-workflow-executor-4.0 | 0 | 4.0.3-r2 |
| Wolfi | argo-workflows-3.7 | 0 | 3.7.12-r2 |
| Wolfi | argo-workflows-4.0 | 0 | 4.0.3-r2 |
| Wolfi | argocd-image-updater | 0 | 1.1.1-r5 |
| Wolfi | bom | 0 | 0.7.1-r11 |
| Wolfi | cerbos | 0 | 0.51.0-r10 |
| Wolfi | cerbosctl | 0 | 0.51.0-r10 |
| Wolfi | chezmoi | 0 | 2.70.0-r1 |
| Wolfi | crossplane-2.1-crank | 0 | 2.1.4-r8 |
| Wolfi | crossplane-2.2-crank | 0 | 2.2.0-r5 |
| Wolfi | dagger | 0 | 0.20.3-r1 |
| Wolfi | external-secrets-operator-2.2 | 0 | 2.2.0-r1 |
| Wolfi | flux-2.6 | 0 | 2.6.4-r16 |
| Wolfi | flux-2.7 | 0 | 2.7.5-r11 |
| Wolfi | flux-2.8 | 0 | 2.8.3-r3 |
| Wolfi | flux-image-automation-controller | 0 | 1.1.1-r9 |
| Wolfi | flux-source-controller | 0 | 1.8.1-r3 |
| Wolfi | gitaly-18.10 | 0 | 18.10.2-r1 |
| Wolfi | gitaly-18.8 | 0 | 18.8.8-r1 |
| Wolfi | gitaly-18.9 | 0 | 18.9.4-r1 |
| Wolfi | gitea | 0 | 1.25.5-r3 |
| Wolfi | gitlab-runner-18.7 | 0 | 18.7.2-r10 |
| Wolfi | gitlab-runner-helper-18.7 | 0 | 18.7.2-r10 |
| Wolfi | gitsign | 0 | 0.14.0-r12 |
| Wolfi | gomplate-5 | 0 | 5.0.0-r13 |
| Wolfi | grafana-alloy | 0 | 1.15.0-r2 |
| Wolfi | grype | 0 | 0.110.0-r1 |
| Wolfi | k9s | 0 | 0.50.18-r13 |
| Wolfi | kargo | 0 | 1.9.5-r7 |
| Wolfi | kots | 0 | 1.129.4-r5 |
| Wolfi | kubevela-vela-cli | 0 | 1.10.7-r6 |
| Wolfi | kubevela-vela-core | 0 | 1.10.7-r6 |
| Wolfi | kyverno-cli-1.15 | 0 | 1.15.3-r8 |
| Wolfi | kyverno-cli-1.16 | 0 | 1.16.3-r11 |
| Wolfi | kyverno-cli-1.17 | 0 | 1.17.1-r8 |
| Wolfi | melange | 0 | 0.48.0-r0 |
| Wolfi | nfpm | 0 | 2.45.2-r4 |
| Wolfi | nuclei | 0 | 3.7.1-r5 |
| Wolfi | pulumi | 0 | 3.229.0-r2 |
| Wolfi | pulumi-kubernetes-operator | 0 | 2.6.0-r1 |
| Wolfi | pulumi-language-dotnet | 0 | 3.102.0-r3 |
| Wolfi | pulumi-language-go | 0 | 3.229.0-r2 |
| Wolfi | pulumi-language-java | 0 | 1.21.3-r4 |
| Wolfi | pulumi-language-nodejs | 0 | 3.229.0-r2 |
| Wolfi | pulumi-language-python | 0 | 3.229.0-r2 |
| Wolfi | pulumi-language-yaml | 0 | 1.30.1-r3 |
| Wolfi | rancher-fleet-cli | 0 | 0.15.0-r1 |
| Wolfi | skaffold | 0 | 2.18.2-r2 |
| Wolfi | snyk-cli | 0 | 1.1303.2-r1 |
| Wolfi | syft | 0 | 1.42.3-r1 |
| Wolfi | teleport-17 | 0 | 17.7.20-r5 |
| Wolfi | teleport-18 | 0 | 18.7.2-r6 |
| Wolfi | teleport-18.6 | 0 | 18.6.8-r9 |
| Wolfi | tfsec | 0 | 1.28.14-r24 |
| Wolfi | trivy | 0 | 0.69.3-r6 |
| Wolfi | trivy-operator | 0 | 0.30.1-r4 |
| Wolfi | trufflehog | 0 | 3.94.1-r1 |
| Wolfi | witness | 0 | 0.10.2-r16 |
| Wolfi | wolfictl | 0 | 0.39.7-r1 |
Related vulnerabilities
- CVE-2026-34986 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of… Also affects amazon-ssm-agent
- CVE-2026-34165 go-git is an extensible git implementation library written in pure Go. Also affects amazon-ssm-agent
- CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Also affects amazon-ssm-agent
- CVE-2026-27141 Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to… Also affects amazon-ssm-agent
- CVE-2026-1229 The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an… Also affects amazon-ssm-agent
- CVE-2026-26958 filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with… Also affects amazon-ssm-agent
- CVE-2026-25934 go-git is a highly extensible git implementation library written in pure Go. Also affects amazon-ssm-agent
- CVE-2025-68121 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or… Also affects amazon-ssm-agent