Data Integrity Vulnerability in Go-Git Library by The Go Project
CVE-2026-25934

4.3MEDIUM

Key Information:

Vendor

Go-git

Status
Go-git
Vendor
CVE Published:
9 February 2026

What is CVE-2026-25934?

The go-git library, an extensible implementation of Git written in Go, has a vulnerability where it fails to properly verify data integrity for .pack and .idx files prior to version 5.16.5. This oversight allows the library to potentially process corrupted files, which may lead to errors such as 'object not found'. When clients fetch packfiles from upstream Git servers, they are expected to perform integrity checks using checksums. However, go-git was not reliably conducting these checks, increasing the risk of data corruption. This issue has been addressed in version 5.16.5.

Affected Version(s)

go-git < 5.16.5

References

https://github.com/go-git/go-git/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/go-git/go-git/releases/tag/v5.16.5
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.