CVE-2026-33762

Katalog CVE

CVSS 2.8 · Low EPSS 0,15%

Kerentanan Improper Validation of Array Index pada go-git project go-git. Skor CVSS 3.1 2.8 (Low) menurut github.com.

Deskripsi (NVD)

go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing. This issue only affects Git index format version 4. Earlier formats (go-git supports only v2 and v3) are not vulnerable to this issue. This issue has been patched in version 5.17.1.

Rincian

Terbit di NVD

31 Maret 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

2.8 (Low), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-129: Improper Validation of Array Index

EPSS (30 hari)

0,15% peluang dieksploitasi; lebih tinggi dari 3,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/go-git/go-git/security/advisories/GHSA-gm2x-2g9h-ccm8 advisory vendor
• https://github.com/go-git/go-git/releases/tag/v5.17.1 product · release notes