GHSA-jhf3-xxhw-2wpp

    Dashboard / Vulnerabilities / GHSA-jhf3-xxhw-2wpp

    GHSA-jhf3-xxhw-2wpp

    Published: 30 Mar 2026Last Modified: 10 Sept 2026

    Summary: go-git: Maliciously crafted idx file can cause asymmetric memory consumption

    Details: ### Impact A vulnerability has been identified in which a maliciously crafted `.idx` file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a Denial of Service (DoS) condition. Exploitation requires write access to the local repository's `.git` directory, it order to create or alter existing `.idx` files. ### Patches Users should upgrade to `v5.17.1`, or the latest `v6` [pseudo-version](https://go.dev/ref/mod#pseudo-versions), in order to mitigate this vulnerability. ### Credit The go-git maintainers thank @kq5y for finding and reporting this issue privately to the `go-git` project.

    References: https://github.com/go-git/go-git/security/advisories/GHSA-jhf3-xxhw-2wpp, https://nvd.nist.gov/vuln/detail/CVE-2026-34165, https://github.com/go-git/go-git, https://github.com/go-git/go-git/releases/tag/v5.17.1

    Affected packages

    Package

    Name: github.com/go-git/go-git/v5

    Purl: pkg:golang/github.com/go-git/go-git/v5

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 5.0.0
    Fixed -5.17.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-jhf3-xxhw-2wpp | CVE-DB