Maliciously crafted Git server replies can cause DoS on go-git clients

CVE-2023-49568

Summary

A denial of service vulnerability exists in go-git versions prior to v5.11, allowing attackers to exploit the system through specially crafted responses from a Git server. This attack can lead to resource exhaustion in go-git clients, affecting system performance and availability. Notably, applications that utilize only the in-memory filesystem provided by go-git remain unaffected. This issue is identified as a specific implementation vulnerability within go-git and does not impact the upstream Git command-line interface.

References