| id: GO-2026-5074 |
| modules: |
| - module: github.com/go-git/go-git/v5 |
| versions: |
| - fixed: 5.19.0 |
| vulnerable_at: 5.18.0 |
| packages: |
| - package: github.com/go-git/go-git/v5/plumbing/object |
| symbols: |
| - Commit.Decode |
| - Tag.Decode |
| derived_symbols: |
| - Commit.IsAncestor |
| - Commit.MergeBase |
| - Commit.Parent |
| - Commit.Stats |
| - Commit.StatsContext |
| - DecodeCommit |
| - DecodeObject |
| - DecodeTag |
| - GetCommit |
| - GetObject |
| - GetTag |
| - Independents |
| - NewCommitAllIter |
| - ObjectIter.Next |
| - Tag.Commit |
| - Tag.Object |
| - Tag.String |
| - Tag.Tree |
| - TagIter.Next |
| - bfsCommitIterator.ForEach |
| - bfsCommitIterator.Next |
| - commitIteratorByCTime.ForEach |
| - commitIteratorByCTime.Next |
| - commitPostIterator.ForEach |
| - commitPostIterator.Next |
| - commitPreIterator.ForEach |
| - commitPreIterator.Next |
| - filterCommitIter.ForEach |
| - filterCommitIter.Next |
| - storerCommitIter.ForEach |
| - storerCommitIter.Next |
| summary: |- |
| Go-git: Improper parsing of specially crafted objects may lead to inconsistent |
| interpretation in github.com/go-git/go-git |
| cves: |
| - CVE-2026-45022 |
| ghsas: |
| - GHSA-389r-gv7p-r3rp |
| references: |
| - advisory: https://github.com/go-git/go-git/security/advisories/GHSA-389r-gv7p-r3rp |
| - web: https://github.com/go-git/go-git/releases/tag/v5.19.0 |
| source: |
| id: GHSA-389r-gv7p-r3rp |
| created: 2026-07-23T19:31:09.452054-04:00 |
| review_status: REVIEWED |
