CVE-2023-49568 — Improper Input Validation in Go-git Go-git V5

CWE-20 — Improper Input ValidationCWE-400 — Uncontrolled Resource Consumption10 documents7 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 70.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
10
Github.com Go-git Go-git V5Go-git Project Go-gitDebian Golang-github-go-git-go-git+7 more
Timeline
PublishedJan 12
Latest updateMar 12

Description

A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Applications using only the in-memory filesystem supported by go-git are not affected by this vulnerability. This is a go-git implementation issue and does not affect the upstream git cli.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages10 packages

▶NVDgo-git_project/go-git4.0.0 — 5.11.0
▶Gogithub.com/go-git_go-git_v55.0.0 — 5.11.0+1
▶debiandebian/golang-github-go-git-go-git< golang-github-go-git-go-git 5.11.0-1 (forky)
▶Gogopkg.in/src-d_go-git.v44.7.1 — 4.13.1+1
▶CVEListV5go-git/go-git5.11.0

🔴Vulnerability Details

5
OSV
golang-github-go-git-go-git vulnerabilities↗2026-03-12
▶
OSV
Denial of service in github.com/go-git/go-git/v5 and gopkg.in/src-d/go-git.v4↗2024-01-23
▶
OSV
CVE-2023-49568: A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5↗2024-01-12
▶
GHSA
Maliciously crafted Git server replies can cause DoS on go-git clients↗2023-12-27
▶
OSV
Maliciously crafted Git server replies can cause DoS on go-git clients↗2023-12-27
▶

📋Vendor Advisories

4
Ubuntu
go-git vulnerabilities↗2026-03-12
▶
Microsoft
Maliciously crafted Git server replies can cause DoS on go-git clients↗2024-01-09
▶
Red Hat
go-git: Maliciously crafted Git server replies can cause DoS on go-git clients↗2023-12-24
▶
Debian
CVE-2023-49568: golang-github-go-git-go-git - A denial of service (DoS) vulnerability was discovered in go-git versions prior ...↗2023
▶