CVE-2026-25934: go-git improperly verifies data integrity values for .idx and .pack files
Impact
A vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found.
For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly.
Note that the lack of verification of the packfile checksum has no impact on the trust relationship between the client and server, which is enforced based on the protocol being used (e.g. TLS in the case of https:// or known hosts for ssh://). In other words, the packfile checksum verification does not provide any security benefits when connecting to a malicious or compromised Git server.
Patches
Users should upgrade to v5.16.5, or the latest v6 pseudo-version, in order to mitigate this vulnerability.
Workarounds
In case updating to a fixed version of go-git is not possible, users can run git fsck from the git cli to check for data corruption on a given repository.
Credit
Thanks @N0zoM1z0 for finding and reporting this issue privately to the go-git project.
Other sources
go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25934?
CVE-2026-25934 has been classified with a severity rating that reflects the potential impact of improper data integrity verification in go-git.
How do I fix CVE-2026-25934?
To mitigate CVE-2026-25934, upgrade to go-git version 5.16.5 or later where the vulnerability has been addressed.
What are the potential risks of CVE-2026-25934?
The risks associated with CVE-2026-25934 include the potential for data corruption and unauthorized access to repository contents due to flawed integrity checks.
Which versions of go-git are affected by CVE-2026-25934?
CVE-2026-25934 affects all versions of go-git prior to 5.16.5.
Can CVE-2026-25934 lead to security breaches?
Yes, CVE-2026-25934 can lead to security breaches by allowing attackers to exploit the improper verification of .idx and .pack file data.