Skip to content
Fencer Vulns
high 7.5

CVE-2026-45022 json

go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git

published 2026-05-11 5 mo ago modified 2026-09-10 1 mo ago also EUVD-2026-32542 , GHSA-389r-gv7p-r3rp , GO-2026-5074

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 5%
public exploits
0
none known

Summary

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-git’s decoded representation may expose values differently from how Git itself would interpret or reject the same object. Additionally, go-git’s commit signing and verification logic operates over commit data reconstructed from go-git’s parsed representation rather than the original raw object bytes. As a result, go-git may sign or verify a commit payload that is not byte-for-byte equivalent to the object stored in the repository. This can cause a signature to appear valid for a commit whose displayed or effective metadata differs from the object that was intended to be signed. This vulnerability is fixed in 5.19.0 and 6.0.0-alpha.3.

Patch / fix

  • go github.com/go-git/go-git/v6 6.0.0-alpha.3
  • go github.com/go-git/go-git/v5 5.19.0
  • go-git_project go-git 5.19.0, 6.0.0-alpha.3
  • golang-github-go-git-go-git Debian 14 5.19.1-1
  • golang-github-go-git-go-git-v6 Debian 14 6.0.0~alpha4-1

debian advisories DEBIAN-CVE-2026-45022

  • govulncheck-vulndb SLES 16.0, SLES for SAP applications 16.0 0.0.20260727T201416-160000.1.1

suse advisories SUSE-SU-2026:23216-1SUSE-SU-2026:23227-1

  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260727T201416-160000.1.1
  • flux2-cli openSUSE Tumbleweed 2.8.7-1.1

opensuse advisories openSUSE-SU-2026:21551-1openSUSE-SU-2026:10769-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-45022 updated cvss 5.7

github.com/go-git/go-git: go-git: Signature spoofing due to malformed Git object parsing

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

0.16% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 7.0 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
CNA 4.0 7.0 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
go github.com/go-git/go-git/v6
>=6.0.0-alpha.1, <6.0.0-alpha.3
6.0.0-alpha.3
go github.com/go-git/go-git/v5
<5.19.0
5.19.0

Affected products

  • go-git go-git

Classification

Weakness
  • CWE-180 Incorrect Behavior Order: Validate Before Canonicalize
  • CWE-345 Insufficient Verification of Data Authenticity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.