https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T19:57:36.526165+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-gj00206 Withdrawn: CLEANSTART-2026-GJ00206 — Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the… 2026-10-03T19:57:36.657001+00:00

Withdrawn by the publisher.

Affected: CleanStart: gitea

Multiple security vulnerabilities affect the gitea package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-349402 EUVD-2026-349402 2026-10-03T19:57:36.657054+00:00 EUVD-2026-349402 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71557 fkie_cve-2026-71557 2026-10-03T19:57:36.657071+00:00

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.

 https://cve.radiocsirt.org/vuln/ghsa-qgq7-7hm3-q39j GHSA-qgq7-7hm3-q39j — go-git: Malicious reference names may modify files outside the reference storage 2026-10-03T19:57:36.657095+00:00

Affected: Go: github.com/go-git/go-git/v5, Go: github.com/go-git/go-git/v6

### Impact A path traversal issue in `go-git` could allow malicious reference names to access files outside the repository's intended reference storage.

Loose references are stored under `.git/<reference-name>`. The reference name was previously used as a path without verifying that the resolved path remained within the reference storage. A name such as `refs/heads/../../config` could therefore resolve to unrelated repository metadata such as `.git/config` or `.git/HEAD`.

A malicious Git server could advertise such a reference name. The name may also survive refspec mapping; for example, it could be mapped to `refs/remotes/origin/../../config` during a clone or fetch operation.

This vulnerability affects filesystem-backed repositories using the `storage/filesystem` package and its `dotgit` reference storage. Users relying exclusively on the in-memory storage implementation, `storage/memory`, are not affected, because reference names are not resolved as filesystem paths.

Exploitation requires an application using `go-git` with filesystem-backed storage to interact with a malicious Git server or otherwise process attacker-controlled reference names.

### Patches The issue has been addressed by validating reference names at the `dotgit` storage entry points and rejecting names whose resolved paths could escape the reference storage.

Users of filesystem-backed storage should upgrade to a patched version.

### Workarounds Applications that exclusively use `storage/memory` ar…

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-71557 msrc_CVE-2026-71557 — go-git: Malicious reference names may modify files outside the reference storage 2026-10-03T19:57:36.657142+00:00 msrc_CVE-2026-71557 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11803-1 openSUSE-SU-2026:11803-1 — alloy-1.19.2-1.1 on GA media 2026-10-03T19:57:36.657160+00:00

alloy-1.19.2-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:66208 RHSA-2026:66208 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update 2026-10-03T19:57:36.657183+00:00

github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution github.com/go-git/go-git: github.com/go-git/go-git/v5: go-git: Unauthorized file modification via directory traversal in reference names

 https://cve.radiocsirt.org/vuln/suse-su-2026:4286-1 SUSE-SU-2026:4286-1 — Security update for amazon-ssm-agent 2026-10-03T19:57:36.657200+00:00

Security update for amazon-ssm-agent

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-71557 UBUNTU-CVE-2026-71557 2026-10-03T19:57:36.657216+00:00

Affected: Ubuntu:Pro:22.04:LTS: golang-github-go-git-go-git, Ubuntu:Pro:24.04:LTS: golang-github-go-git-go-git, Ubuntu:Pro:26.04:LTS: golang-github-go-git-go-git

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.