go-git: Maliciously crafted idx file can cause asymmetric memory consumption

中 5.0CVE-2026-34165 · GHSA-jhf3-xxhw-2wpp · GO-2026-4910 · 31/03/2026 公開 · 24/07/2026 更新

要点

CVE-2026-34165 は github.com/go-git/go-git, github.com/go-git/go-git/v4, github.com/go-git/go-git/v5 に影響する深刻度「中」 (CVSS 5.0) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.15%（全脆弱性の 4.4% より高い）。
対処：5.17.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/go-git/go-git Go	`全バージョン`	修正版なし
github.com/go-git/go-git/v4 Go	`全バージョン`	修正版なし
github.com/go-git/go-git/v5 Go	`≥ 5.0.0, < 5.17.1`	`5.17.1`
go-git go-git_project	`≥ 5.0.0, < 5.17.1`	`5.17.1`

概要

Impact

A vulnerability has been identified in which a maliciously crafted .idx file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a Denial of Service (DoS) condition.

Exploitation requires write access to the local repository's .git directory, it order to create or alter existing .idx files.

Patches

Users should upgrade to v5.17.1, or the latest v6 pseudo-version, in order to mitigate this vulnerability.

Credit

The go-git maintainers thank @kq5y for finding and reporting this issue privately to the go-git project.

NVD の説明

go-git is an extensible git implementation library written in pure Go. From version 5.0.0 to before version 5.17.1, a vulnerability has been identified in which a maliciously crafted .idx file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a denial-of-service (DoS) condition. Exploitation requires write access to the local repository's .git directory, it order to create or alter existing .idx files. This issue has been patched in version 5.17.1.