CRITICAL9.8Go
GHSA-449p-3h89-pw88· CVE-2023-49569, GO-2024-2456Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients
Modified: 9/10/2026
package
Go/gopkg.in/src-d/go-git.v4
pkg:go/gopkg.in/src-d/go-git.v4
HIGH7.5Go
GHSA-mw99-9chc-xw7r· CVE-2023-49568, GO-2024-2466Maliciously crafted Git server replies can cause DoS on go-git clients
Modified: 9/10/2026
HIGH7.5Go
GHSA-r9px-m959-cxf4· CVE-2025-21614, GO-2025-3367go-git clients vulnerable to DoS via maliciously crafted Git server replies
Modified: 9/10/2026
CRITICAL9.8Go
GHSA-v725-9546-7q7m· CVE-2025-21613, GO-2025-3368go-git has an Argument Injection via the URL field
Modified: 9/10/2026
—Go
GO-2024-2456· CVE-2023-49569, GHSA-449p-3h89-pw88Path traversal and RCE in github.com/go-git/go-git/v5 and gopkg.in/src-d/go-git.v4
Modified: 2/4/2026
—Go
GO-2024-2466· CVE-2023-49568, GHSA-mw99-9chc-xw7rDenial of service in github.com/go-git/go-git/v5 and gopkg.in/src-d/go-git.v4
Modified: 2/4/2026
—Go
GO-2025-3367· CVE-2025-21614, GHSA-r9px-m959-cxf4Clients vulnerable to DoS via maliciously crafted Git server replies in github.com/go-git/go-git
Modified: 2/4/2026
—Go
GO-2025-3368· CVE-2025-21613, GHSA-v725-9546-7q7mArgument Injection via the URL field in github.com/go-git/go-git
Modified: 7/8/2026