| id: GO-2026-5074 | |
| modules: | |
| - module: github.com/go-git/go-git/v5 | |
| versions: | |
| - fixed: 5.19.0 | |
| vulnerable_at: 5.18.0 | |
| packages: | |
| - package: github.com/go-git/go-git/v5/plumbing/object | |
| symbols: | |
| - Commit.Decode | |
| - Tag.Decode | |
| derived_symbols: | |
| - Commit.IsAncestor | |
| - Commit.MergeBase | |
| - Commit.Parent | |
| - Commit.Stats | |
| - Commit.StatsContext | |
| - DecodeCommit | |
| - DecodeObject | |
| - DecodeTag | |
| - GetCommit | |
| - GetObject | |
| - GetTag | |
| - Independents | |
| - NewCommitAllIter | |
| - ObjectIter.Next | |
| - Tag.Commit | |
| - Tag.Object | |
| - Tag.String | |
| - Tag.Tree | |
| - TagIter.Next | |
| - bfsCommitIterator.ForEach | |
| - bfsCommitIterator.Next | |
| - commitIteratorByCTime.ForEach | |
| - commitIteratorByCTime.Next | |
| - commitPostIterator.ForEach | |
| - commitPostIterator.Next | |
| - commitPreIterator.ForEach | |
| - commitPreIterator.Next | |
| - filterCommitIter.ForEach | |
| - filterCommitIter.Next | |
| - storerCommitIter.ForEach | |
| - storerCommitIter.Next | |
| summary: |- | |
| Go-git: Improper parsing of specially crafted objects may lead to inconsistent | |
| interpretation in github.com/go-git/go-git | |
| cves: | |
| - CVE-2026-45022 | |
| ghsas: | |
| - GHSA-389r-gv7p-r3rp | |
| references: | |
| - advisory: https://github.com/go-git/go-git/security/advisories/GHSA-389r-gv7p-r3rp | |
| - web: https://github.com/go-git/go-git/releases/tag/v5.19.0 | |
| source: | |
| id: GHSA-389r-gv7p-r3rp | |
| created: 2026-07-23T19:31:09.452054-04:00 | |
| review_status: REVIEWED |