CVE-2026-25934— go-git improperly verifies data integrity values for .idx and .pack files
Quick assessment
Affected
go-git go-git
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
go-git是go-git开源的一个用纯 Go 编写的高度可扩展的 git 实现库。 go-git 5.16.5之前版本存在安全漏洞，该漏洞源于.pack和.idx文件的数据完整性值未正确验证，可能导致使用损坏文件并引发错误。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-25934
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
go-git improperly verifies data integrity values for .idx and .pack files
Source: CVE Program / CVE List V5
Vulnerability Description
go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
完整性检查值验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
go-git 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
go-git是go-git开源的一个用纯 Go 编写的高度可扩展的 git 实现库。 go-git 5.16.5之前版本存在安全漏洞，该漏洞源于.pack和.idx文件的数据完整性值未正确验证，可能导致使用损坏文件并引发错误。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-25934
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-25934
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: go-git
-
CVE-2026-71557
go-git: Malicious reference names may modify files outside t -
CVE-2026-71556
go-git: Worktree operations may follow symlinks -
CVE-2026-45570
go-git: Improper single-quote escaping in go-git SSH transpo -
CVE-2026-45571
go-git: Crafted repositories may modify main and submodule . -
CVE-2026-45022
go-git: Improper parsing of specially crafted objects may le
Same vendor: go-git
-
CVE-2026-71557
go-git: Malicious reference names may modify files outside t -
CVE-2026-71556
go-git: Worktree operations may follow symlinks -
CVE-2026-44740
go-billy: Lack of depth and cycle detection in symlink resol -
CVE-2026-44973
Billy: Path traversal vulnerabilities -
CVE-2026-45570
go-git: Improper single-quote escaping in go-git SSH transpo
Same weakness: CWE-354
-
CVE-2026-71888
CMS AuthenticatedData exposes attacker-inserted authAttrs wh -
CVE-2026-85515
OpenPGP message truncation not reported, bypassing the SEIPD -
CVE-2026-103601
CcmBlockCipher and KCcmBlockCipher leave unverified plaintex -
CVE-2026-16001
IesEngine stream-mode MAC forgery via length-dependent KDF s -
CVE-2026-15999
AES-CCM decryption accepts zero or out-of-range tag length,
V. Comments for CVE-2026-25934
No comments yet