id: GO-2025-3367
modules:
    - module: github.com/go-git/go-git/v4
      versions:
        - introduced: 4.0.0
      vulnerable_at: 4.13.1
    - module: github.com/go-git/go-git/v5
      versions:
        - fixed: 5.13.0
      vulnerable_at: 5.12.0
    - module: gopkg.in/src-d/go-git.v4
      versions:
        - introduced: 4.0.0
      vulnerable_at: 4.13.1
summary: Clients vulnerable to DoS via maliciously crafted Git server replies in github.com/go-git/go-git
cves:
    - CVE-2025-21614
ghsas:
    - GHSA-r9px-m959-cxf4
credits:
    - Ionut Lalu
references:
    - advisory: https://github.com/go-git/go-git/security/advisories/GHSA-r9px-m959-cxf4
notes:
    - I could not find a fix commit, so leaving all packages vulnerable.
source:
    id: GHSA-r9px-m959-cxf4
    created: 2025-01-06T15:18:07.39952-10:00
review_status: REVIEWED