Malformed Git Object Parsing in go-git Library

CVE-2026-45022

What is CVE-2026-45022?

The go-git library, an extensible Git implementation in pure Go, has a vulnerability that arises when processing ambiguous or malformed headers in Git commit or tag objects. Prior versions may handle these malformed objects in a way that differs from the original Git implementation. Consequently, the library's signing and verification logic utilizes a reconstructed version of the commit data, which may lead to discrepancies between the actual repository object and the signed payload. This could result in a situation where a commit appears to have a valid signature, even if the underlying metadata diverges from the intended object.

References