Out-of-Bounds Slice Operation in go-git Git Library

CVE-2026-33762

What is CVE-2026-33762?

The go-git library, a pure Go implementation for Git, contains a vulnerability in its index decoder for format version 4. Prior to version 5.17.1, this component fails to properly validate the path name prefix length when decoding. An attacker can exploit this issue by crafting a malicious index file, leading to an out-of-bounds slice operation that results in a runtime panic during normal index parsing. This vulnerability specifically impacts Git index format version 4, while earlier formats (v2 and v3) remain unaffected. Users are advised to upgrade to version 5.17.1 or later to mitigate this risk.

References