CVE-2026-34165
Medium · 5.0CVSS
5.0
EPSS
0.1%
Published
Mar 31, 2026
CISA due date
—
The record
go-git is an extensible git implementation library written in pure Go. From version 5.0.0 to before version 5.17.1, a vulnerability has been identified in which a maliciously crafted .idx file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a denial-of-service (DoS) condition. Exploitation requires write access to the local repository's .git directory, it order to create or alter existing .idx files. This issue has been patched in version 5.17.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | amazon-ssm-agent | 0 | 3.3.3270.0-r10 |
| Chainguard | amazon-ssm-agent-ecs-exec | 0 | 3.3.3270.0-r10 |
| Chainguard | amazon-ssm-agent-ecs-exec-fips | 0 | 3.3.3270.0-r11 |
| Chainguard | amazon-ssm-agent-fips | 0 | 3.3.3270.0-r11 |
| Chainguard | apko | 0 | 1.2.0-r1 |
| Chainguard | apko-fips | 0 | 1.2.1-r0 |
| Chainguard | argo-cd-3.1 | 0 | 3.1.13-r1 |
| Chainguard | argo-cd-3.1-compat | 0 | 3.1.13-r1 |
| Chainguard | argo-cd-3.2 | 0 | 3.2.8-r1 |
| Chainguard | argo-cd-3.2-compat | 0 | 3.2.8-r1 |
| Chainguard | argo-cd-3.3 | 0 | 3.3.6-r2 |
| Chainguard | argo-cd-3.3-compat | 0 | 3.3.6-r2 |
| Chainguard | argo-cd-fips-3.1 | 0 | 3.1.13-r1 |
| Chainguard | argo-cd-fips-3.1-compat | 0 | 3.1.13-r1 |
| Chainguard | argo-cd-fips-3.2 | 0 | 3.2.8-r1 |
| Chainguard | argo-cd-fips-3.2-compat | 0 | 3.2.8-r1 |
| Chainguard | argo-cd-fips-3.3 | 0 | 3.3.5-r1 |
| Chainguard | argo-cd-fips-3.3-compat | 0 | 3.3.5-r1 |
| Chainguard | argo-events | 0 | 1.9.10-r14 |
| Chainguard | argo-workflow-executor-3.7 | 0 | 3.7.12-r2 |
| Chainguard | argo-workflow-executor-4.0 | 0 | 4.0.3-r2 |
| Chainguard | argo-workflow-executor-fips-3.7 | 0 | 3.7.12-r2 |
| Chainguard | argo-workflow-executor-fips-4.0 | 0 | 4.0.3-r2 |
| Chainguard | argo-workflows-3.7 | 0 | 3.7.12-r2 |
| Chainguard | argo-workflows-4.0 | 0 | 4.0.3-r2 |
| Chainguard | argo-workflows-fips-4.0 | 0 | 4.0.3-r2 |
| Chainguard | argocd-image-updater | 0 | 1.1.1-r5 |
| Chainguard | argocd-image-updater-fips | 0 | 1.1.1-r6 |
| Chainguard | bom | 0 | 0.7.1-r11 |
| Chainguard | cerbos | 0 | 0.51.0-r10 |
| Chainguard | cerbos-fips | 0 | 0.51.0-r7 |
| Chainguard | cerbosctl | 0 | 0.51.0-r10 |
| Chainguard | cerbosctl-fips | 0 | 0.51.0-r7 |
| Chainguard | cg | 0 | 0.2.232-r0 |
| Chainguard | chezmoi | 0 | 2.70.0-r1 |
| Chainguard | cloudbeat-8.19 | 0 | 8.19.13-r3 |
| Chainguard | cloudbeat-9.2 | 0 | 9.2.7-r3 |
| Chainguard | cloudbeat-9.3 | 0 | 9.3.2-r2 |
| Chainguard | cloudbeat-fips-8.19 | 0 | 8.19.13-r2 |
| Chainguard | cloudbeat-fips-9.3 | 0 | 9.3.2-r3 |
| Chainguard | crossplane-1.20-crank | 0 | 1.20.5-r8 |
| Chainguard | crossplane-2.0-crank | 0 | 2.0.7-r7 |
| Chainguard | crossplane-2.1-crank | 0 | 2.1.4-r8 |
| Chainguard | crossplane-2.2-crank | 0 | 2.2.0-r5 |
| Chainguard | crossplane-fips-1.20-crank | 0 | 1.20.5-r9 |
| Chainguard | crossplane-fips-2.0-crank | 0 | 2.0.7-r9 |
| Chainguard | crossplane-fips-2.1-crank | 0 | 2.1.4-r9 |
| Chainguard | crossplane-fips-2.2-crank | 0 | 2.2.0-r7 |
| Chainguard | dagger | 0 | 0.20.3-r1 |
| Chainguard | external-secrets-operator-2.2 | 0 | 2.2.0-r1 |
| Chainguard | external-secrets-operator-fips-2.2 | 0 | 2.2.0-r1 |
| Chainguard | flux-2.6 | 0 | 2.6.4-r16 |
| Chainguard | flux-2.7 | 0 | 2.7.5-r11 |
| Chainguard | flux-2.8 | 0 | 2.8.3-r3 |
| Chainguard | flux-fips-2.6 | 0 | 2.6.4-r16 |
| Chainguard | flux-fips-2.7 | 0 | 2.7.5-r10 |
| Chainguard | flux-image-automation-controller | 0 | 1.1.1-r9 |
| Chainguard | flux-image-automation-controller-fips | 0 | 1.1.1-r2 |
| Chainguard | flux-source-controller | 0 | 1.8.1-r3 |
| Chainguard | flux-source-controller-fips | 0 | 1.8.1-r2 |
| Chainguard | gitaly-18.10 | 0 | 18.10.2-r1 |
| Chainguard | gitaly-18.8 | 0 | 18.8.8-r1 |
| Chainguard | gitaly-18.9 | 0 | 18.9.4-r1 |
| Chainguard | gitea | 0 | 1.25.5-r3 |
| Chainguard | gitea-fips | 0 | 1.25.5-r2 |
| Chainguard | gitlab-runner-18.7 | 0 | 18.7.2-r10 |
| Chainguard | gitlab-runner-helper-18.7 | 0 | 18.7.2-r10 |
| Chainguard | gitsign | 0 | 0.14.0-r12 |
| Chainguard | gomplate-4 | 0 | 4.3.3-r6 |
| Chainguard | gomplate-5 | 0 | 5.0.0-r13 |
| Chainguard | gomplate-fips-4 | 0 | 4.3.3-r7 |
| Chainguard | gomplate-fips-5 | 0 | 5.0.0-r12 |
| Chainguard | google-osconfig-agent | 0 | 20251028.00-r12 |
| Chainguard | grafana-alloy | 0 | 1.15.0-r2 |
| Chainguard | grafana-alloy-fips | 0 | 1.15.0-r2 |
| Chainguard | grype | 0 | 0.110.0-r1 |
| Chainguard | grype-db | 0 | 0.53.0-r4 |
| Chainguard | grype-fips | 0 | 0.110.0-r1 |
| Chainguard | jfrog-cli | 0 | 2.97.0-r1 |
| Chainguard | k9s | 0 | 0.50.18-r13 |
| Chainguard | k9s-fips | 0 | 0.50.18-r12 |
| Chainguard | kargo | 0 | 1.9.5-r7 |
| Chainguard | kots | 0 | 1.129.4-r5 |
| Chainguard | kubevela-vela-cli | 0 | 1.10.7-r6 |
| Chainguard | kubevela-vela-cli-fips | 0 | 1.10.7-r7 |
| Chainguard | kubevela-vela-core | 0 | 1.10.7-r6 |
| Chainguard | kubevela-vela-core-fips | 0 | 1.10.7-r7 |
| Chainguard | kyverno-cli-1.15 | 0 | 1.15.3-r8 |
| Chainguard | kyverno-cli-1.16 | 0 | 1.16.3-r11 |
| Chainguard | kyverno-cli-1.17 | 0 | 1.17.1-r8 |
| Chainguard | kyverno-cli-fips-1.15 | 0 | 1.15.3-r8 |
| Chainguard | kyverno-cli-fips-1.16 | 0 | 1.16.3-r11 |
| Chainguard | kyverno-cli-fips-1.17 | 0 | 1.17.1-r8 |
| Chainguard | livekit-cli | 0 | 2.16.0-r5 |
| Chainguard | melange | 0 | 0.48.0-r0 |
| Chainguard | nfpm | 0 | 2.45.2-r4 |
| Chainguard | nuclei | 0 | 3.7.1-r5 |
| Chainguard | packer | 0 | 1.15.1-r1 |
| Chainguard | packer-fips | 0 | 1.15.1-r1 |
| Chainguard | pulumi | 0 | 3.229.0-r2 |
| Chainguard | pulumi-kubernetes-operator | 0 | 2.6.0-r1 |
| Chainguard | pulumi-language-dotnet | 0 | 3.102.0-r3 |
| Chainguard | pulumi-language-go | 0 | 3.229.0-r2 |
| Chainguard | pulumi-language-java | 0 | 1.21.3-r4 |
| Chainguard | pulumi-language-nodejs | 0 | 3.229.0-r2 |
| Chainguard | pulumi-language-python | 0 | 3.229.0-r2 |
| Chainguard | pulumi-language-yaml | 0 | 1.30.1-r3 |
| Chainguard | rancher-fleet-cli | 0 | 0.15.0-r1 |
| Chainguard | rancher-fleet-cli-fips | 0 | 0.15.0-r1 |
| Chainguard | rancher-fleet-controller-fips | 0 | 0.15.0-r1 |
| Chainguard | skaffold | 0 | 2.18.2-r2 |
| Chainguard | skaffold-fips | 0 | 2.18.2-r1 |
| Chainguard | snyk-cli | 0 | 1.1303.2-r1 |
| Chainguard | syft | 0 | 1.42.3-r1 |
| Chainguard | syft-fips | 0 | 1.42.3-r1 |
| Chainguard | teleport-18 | 0 | 18.7.2-r6 |
| Chainguard | teleport-18.6 | 0 | 18.6.8-r9 |
| Chainguard | tfsec | 0 | 1.28.14-r24 |
| Chainguard | trivy | 0 | 0.69.3-r6 |
| Chainguard | trivy-fips | 0 | 0.69.3-r4 |
| Chainguard | trivy-operator | 0 | 0.30.1-r4 |
| Chainguard | trivy-operator-fips | 0 | 0.30.1-r3 |
| Chainguard | trufflehog | 0 | 3.94.1-r1 |
| Chainguard | trufflehog-fips | 0 | 3.94.2-r1 |
| Chainguard | witness | 0 | 0.10.2-r16 |
| Chainguard | wolfictl | 0 | 0.39.7-r1 |
| Chainguard | xeol | 0 | 0.10.8-r30 |
| Chainguard | xeol-fips | 0 | 0.10.8-r29 |
| Chainguard | zarf | 0 | 0.74.0-r2 |
| Chainguard | zarf-fips | 0 | 0.74.1-r0 |
| Chainguard | zot | 0 | 2.1.15-r6 |
| Wolfi | apko | 0 | 1.2.0-r1 |
| Wolfi | argo-cd-3.1 | 0 | 3.1.13-r1 |
| Wolfi | argo-cd-3.1-compat | 0 | 3.1.13-r1 |
| Wolfi | argo-cd-3.2 | 0 | 3.2.8-r1 |
| Wolfi | argo-cd-3.2-compat | 0 | 3.2.8-r1 |
| Wolfi | argo-cd-3.3 | 0 | 3.3.6-r2 |
| Wolfi | argo-cd-3.3-compat | 0 | 3.3.6-r2 |
| Wolfi | argo-events | 0 | 1.9.10-r14 |
| Wolfi | argo-workflow-executor-3.7 | 0 | 3.7.12-r2 |
| Wolfi | argo-workflow-executor-4.0 | 0 | 4.0.3-r2 |
| Wolfi | argo-workflows-3.7 | 0 | 3.7.12-r2 |
| Wolfi | argo-workflows-4.0 | 0 | 4.0.3-r2 |
| Wolfi | argocd-image-updater | 0 | 1.1.1-r5 |
| Wolfi | bom | 0 | 0.7.1-r11 |
| Wolfi | cerbos | 0 | 0.51.0-r10 |
| Wolfi | cerbosctl | 0 | 0.51.0-r10 |
| Wolfi | chezmoi | 0 | 2.70.0-r1 |
| Wolfi | crossplane-2.1-crank | 0 | 2.1.4-r8 |
| Wolfi | crossplane-2.2-crank | 0 | 2.2.0-r5 |
| Wolfi | dagger | 0 | 0.20.3-r1 |
| Wolfi | external-secrets-operator-2.2 | 0 | 2.2.0-r1 |
| Wolfi | flux-2.6 | 0 | 2.6.4-r16 |
| Wolfi | flux-2.7 | 0 | 2.7.5-r11 |
| Wolfi | flux-2.8 | 0 | 2.8.3-r3 |
| Wolfi | flux-image-automation-controller | 0 | 1.1.1-r9 |
| Wolfi | flux-source-controller | 0 | 1.8.1-r3 |
| Wolfi | gitaly-18.10 | 0 | 18.10.2-r1 |
| Wolfi | gitaly-18.8 | 0 | 18.8.8-r1 |
| Wolfi | gitaly-18.9 | 0 | 18.9.4-r1 |
| Wolfi | gitea | 0 | 1.25.5-r3 |
| Wolfi | gitlab-runner-18.7 | 0 | 18.7.2-r10 |
| Wolfi | gitlab-runner-helper-18.7 | 0 | 18.7.2-r10 |
| Wolfi | gitsign | 0 | 0.14.0-r12 |
| Wolfi | gomplate-5 | 0 | 5.0.0-r13 |
| Wolfi | grafana-alloy | 0 | 1.15.0-r2 |
| Wolfi | grype | 0 | 0.110.0-r1 |
| Wolfi | k9s | 0 | 0.50.18-r13 |
| Wolfi | kargo | 0 | 1.9.5-r7 |
| Wolfi | kots | 0 | 1.129.4-r5 |
| Wolfi | kubevela-vela-cli | 0 | 1.10.7-r6 |
| Wolfi | kubevela-vela-core | 0 | 1.10.7-r6 |
| Wolfi | kyverno-cli-1.15 | 0 | 1.15.3-r8 |
| Wolfi | kyverno-cli-1.16 | 0 | 1.16.3-r11 |
| Wolfi | kyverno-cli-1.17 | 0 | 1.17.1-r8 |
| Wolfi | melange | 0 | 0.48.0-r0 |
| Wolfi | nfpm | 0 | 2.45.2-r4 |
| Wolfi | nuclei | 0 | 3.7.1-r5 |
| Wolfi | pulumi | 0 | 3.229.0-r2 |
| Wolfi | pulumi-kubernetes-operator | 0 | 2.6.0-r1 |
| Wolfi | pulumi-language-dotnet | 0 | 3.102.0-r3 |
| Wolfi | pulumi-language-go | 0 | 3.229.0-r2 |
| Wolfi | pulumi-language-java | 0 | 1.21.3-r4 |
| Wolfi | pulumi-language-nodejs | 0 | 3.229.0-r2 |
| Wolfi | pulumi-language-python | 0 | 3.229.0-r2 |
| Wolfi | pulumi-language-yaml | 0 | 1.30.1-r3 |
| Wolfi | rancher-fleet-cli | 0 | 0.15.0-r1 |
| Wolfi | skaffold | 0 | 2.18.2-r2 |
| Wolfi | snyk-cli | 0 | 1.1303.2-r1 |
| Wolfi | syft | 0 | 1.42.3-r1 |
| Wolfi | teleport-18 | 0 | 18.7.2-r6 |
| Wolfi | teleport-18.6 | 0 | 18.6.8-r9 |
| Wolfi | tfsec | 0 | 1.28.14-r24 |
| Wolfi | trivy | 0 | 0.69.3-r6 |
| Wolfi | trivy-operator | 0 | 0.30.1-r4 |
| Wolfi | trufflehog | 0 | 3.94.1-r1 |
| Wolfi | witness | 0 | 0.10.2-r16 |
| Wolfi | wolfictl | 0 | 0.39.7-r1 |
| Wolfi | xeol | 0 | 0.10.8-r30 |
| Wolfi | zarf | 0 | 0.74.0-r2 |
Related vulnerabilities
- CVE-2026-34986 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of… Also affects amazon-ssm-agent
- CVE-2026-33762 go-git is an extensible git implementation library written in pure Go. Also affects amazon-ssm-agent
- CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Also affects amazon-ssm-agent
- CVE-2026-27141 Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to… Also affects amazon-ssm-agent
- CVE-2026-1229 The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an… Also affects amazon-ssm-agent
- CVE-2026-26958 filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with… Also affects amazon-ssm-agent
- CVE-2026-25934 go-git is a highly extensible git implementation library written in pure Go. Also affects amazon-ssm-agent
- CVE-2025-68121 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or… Also affects amazon-ssm-agent