CVE-2026-63475— isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)

Quick assessment

Affected

isomorphic-git isomorphic-git

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

isomorphic-git 是一个专为 Node.js 和浏览器环境设计的纯 JavaScript 实现的 Git 工具。在版本 1.38.6 之前，isomorphic-git 通过接口持久化服务器提供的包含能力的循环符号引用，而在解析由此产生的松散符号引用时，既未设置默认的深度限制，也缺乏循环检测机制。当从恶意或受中间人攻击控制的远程仓库执行克隆操作后，诸如、、和等需要解析或的操作将陷入无限循环而无法终止。这些循环引用会保留在磁盘上，导致仓库对应用程序不可用，从而引发持续的拒绝服务（DoS）

CVSS 4.3 · Medium Updated Nov 04, 2026

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)

Source: CVE Program / CVE List V5

Vulnerability Description

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the resulting loose symbolic references without a default depth limit or cycle detection. After a clone from a malicious or man-in-the-middle-controlled remote, operations such as log, status, checkout, and branch that resolve refs/remotes/origin/a or refs/remotes/origin/b do not terminate. The circular references remain on disk, leaving the repository unusable for the application and causing a persistent denial of service. This issue is fixed in version 1.38.6.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

未经控制的递归

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
isomorphic-git	isomorphic-git	< 1.38.6	-

II. Public POCs for CVE-2026-63475

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-63475

请登录查看更多情报信息。

Other References for CVE-2026-63475 (4)

https://github.com/isomorphic-git/isomorphic-git/pull/2370 x_refsource_MISC
https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6 x_refsource_MISC
https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-96wc-2m84-2cj7 x_refsource_CONFIRM
https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-63475

Same Patch Batch · isomorphic-git · 2026-11-03 · 4 CVEs total

CVE-2026-63395	8.8 HIGH	isomorphic-git: Arbitrary file write outside the working tree via a directory symlink duri
CVE-2026-63478	5.3 MEDIUM	isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working
CVE-2026-63476	4.3 MEDIUM	isomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (Do

IV. Related Vulnerabilities

Same product: isomorphic-git

Same vendor: isomorphic-git

Same weakness: CWE-674