CVE-2026-33762— go-git: Missing validation decoding Index v4 files leads to panic
Quick assessment
Affected
go-git go-git
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
go-git是go-git开源的一个用纯 Go 编写的高度可扩展的 git 实现库。 go-git 5.17.1之前版本存在输入验证错误漏洞，该漏洞源于索引解码器在应用路径名前缀长度前未进行验证，可能导致解析恶意索引文件时触发越界切片操作和运行时崩溃。
Possible ATT&CK Techniques 1 AI
T1496 · Resource Hijacking
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-33762
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
go-git: Missing validation decoding Index v4 files leads to panic
Source: CVE Program / CVE List V5
Vulnerability Description
go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing. This issue only affects Git index format version 4. Earlier formats (go-git supports only v2 and v3) are not vulnerable to this issue. This issue has been patched in version 5.17.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
对数组索引的验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
go-git 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
go-git是go-git开源的一个用纯 Go 编写的高度可扩展的 git 实现库。 go-git 5.17.1之前版本存在输入验证错误漏洞，该漏洞源于索引解码器在应用路径名前缀长度前未进行验证，可能导致解析恶意索引文件时触发越界切片操作和运行时崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-33762
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-33762
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-33762 (1)
Vendor Pages for CVE-2026-33762 (1)
IV. Related Vulnerabilities
Same product: go-git
-
CVE-2026-71557
go-git: Malicious reference names may modify files outside t -
CVE-2026-71556
go-git: Worktree operations may follow symlinks -
CVE-2026-45570
go-git: Improper single-quote escaping in go-git SSH transpo -
CVE-2026-45571
go-git: Crafted repositories may modify main and submodule . -
CVE-2026-45022
go-git: Improper parsing of specially crafted objects may le
Same vendor: go-git
-
CVE-2026-71557
go-git: Malicious reference names may modify files outside t -
CVE-2026-71556
go-git: Worktree operations may follow symlinks -
CVE-2026-44740
go-billy: Lack of depth and cycle detection in symlink resol -
CVE-2026-44973
Billy: Path traversal vulnerabilities -
CVE-2026-45570
go-git: Improper single-quote escaping in go-git SSH transpo
Same weakness: CWE-129
-
CVE-2026-13212
Zephyr virtio driver calls an arbitrary function pointer fro -
CVE-2026-17097
Power System Improper Validation -
CVE-2026-16849
Vulnerabilities in IBM AIX and PowerVM VIOS -
CVE-2026-73489
Russh: Post-auth remote panic via pty-req with more than 130 -
CVE-2026-73564
frp: Unauthenticated Remote Denial of Service in the frp SSH
V. Comments for CVE-2026-33762
No comments yet