CVE-2026-25934— go-git improperly verifies data integrity values for .idx and .pack files
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-25934
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
go-git improperly verifies data integrity values for .idx and .pack files
Source: NVD (National Vulnerability Database)
Vulnerability Description
go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
完整性检查值验证不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
go-git 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
go-git是go-git开源的一个用纯 Go 编写的高度可扩展的 git 实现库。 go-git 5.16.5之前版本存在安全漏洞，该漏洞源于.pack和.idx文件的数据完整性值未正确验证，可能导致使用损坏文件并引发错误。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-25934
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-25934
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: go-git
- CVE-2026-41506
go-git Credential leak via cross-host redirect in smart HTTP - CVE-2026-33762
go-git: Missing validation decoding Index v4 files leads to - CVE-2026-34165
go-git: Maliciously crafted idx file can cause asymmetric me - CVE-2025-21614
go-git clients vulnerable to DoS via maliciously crafted Git - CVE-2025-21613
go-git has an Argument Injection via the URL field
Same vendor: go-git
- CVE-2026-41506
go-git Credential leak via cross-host redirect in smart HTTP - CVE-2026-33762
go-git: Missing validation decoding Index v4 files leads to - CVE-2026-34165
go-git: Maliciously crafted idx file can cause asymmetric me - CVE-2025-21614
go-git clients vulnerable to DoS via maliciously crafted Git - CVE-2025-21613
go-git has an Argument Injection via the URL field
Same weakness: CWE-354
- CVE-2026-32148
Lockfile checksums not verified in Hex allows dependency int - CVE-2026-32105
xrdp: RDP MAC signature (dataSignature) never verified on re - CVE-2026-5479
wolfSSL EVP ChaCha20-Poly1305 AEAD authentication tag - CVE-2026-5504
PKCS7 CBC Padding Oracle — Plaintext Recovery - CVE-2026-26928
Lack of Dynamic Library Validation in SzafirHost
V. Comments for CVE-2026-25934
No comments yet