CVE-2026-45022
High · 7.5CVSS
7.5
EPSS
0.2%
Published
May 27, 2026
CISA due date
—
The record
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-git’s decoded representation may expose values differently from how Git itself would interpret or reject the same object. Additionally, go-git’s commit signing and verification logic operates over commit data reconstructed from go-git’s parsed representation rather than the original raw object bytes. As a result, go-git may sign or verify a commit payload that is not byte-for-byte equivalent to the object stored in the repository. This can cause a signature to appear valid for a commit whose displayed or effective metadata differs from the object that was intended to be signed. This vulnerability is fixed in 5.19.0 and 6.0.0-alpha.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | flux2-cli | 0 | 2.8.7-1.1 |
Related vulnerabilities
- CVE-2026-45570 go-git is an extensible git implementation library written in pure Go. Also affects flux2-cli
- CVE-2026-45571 go-git is an extensible git implementation library written in pure Go. Also affects flux2-cli
- CVE-2026-102269 PyJWT is a Python implementation of JSON Web Token standards. CWE-180
- CVE-2026-82736 Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash… CWE-180
- CVE-2026-82481 The cohttp package before 6.3.0 for OCaml allows directory traversal. CWE-180
- CVE-2026-76203 Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer… CWE-180
- CVE-2026-73420 NextAuth.js provides authentication for Next.js. CWE-180
- CVE-2026-69245 Guzzle is an extensible PHP HTTP client. CWE-180