Most recent entries from all

Withdrawn: CLEANSTART-2026-GJ00206 — Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the…

Withdrawn by the publisher.

Affected: CleanStart: gitea

Multiple security vulnerabilities affect the gitea package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details.

EUVD-2026-349402

fkie_cve-2026-71557

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.

GHSA-qgq7-7hm3-q39j — go-git: Malicious reference names may modify files outside the reference storage

Affected: Go: github.com/go-git/go-git/v5, Go: github.com/go-git/go-git/v6

### Impact A path traversal issue in `go-git` could allow malicious reference names to access files outside the repository's intended reference storage.

Loose references are stored under `.git/<reference-name>`. The reference name was previously used as a path without verifying that the resolved path remained within the reference storage. A name such as `refs/heads/../../config` could therefore resolve to unrelated repository metadata such as `.git/config` or `.git/HEAD`.

A malicious Git server could advertise such a reference name. The name may also survive refspec mapping; for example, it could be mapped to `refs/remotes/origin/../../config` during a clone or fetch operation.

This vulnerability affects filesystem-backed repositories using the `storage/filesystem` package and its `dotgit` reference storage. Users relying exclusively on the in-memory storage implementation, `storage/memory`, are not affected, because reference names are not resolved as filesystem paths.

Exploitation requires an application using `go-git` with filesystem-backed storage to interact with a malicious Git server or otherwise process attacker-controlled reference names.

### Patches The issue has been addressed by validating reference names at the `dotgit` storage entry points and rejecting names whose resolved paths could escape the reference storage.

Users of filesystem-backed storage should upgrade to a patched version.

### Workarounds Applications that exclusively use `storage/memory` ar…

msrc_CVE-2026-71557 — go-git: Malicious reference names may modify files outside the reference storage

msrc_CVE-2026-71557

openSUSE-SU-2026:11803-1 — alloy-1.19.2-1.1 on GA media

alloy-1.19.2-1.1 on GA media

RHSA-2026:66208 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution github.com/go-git/go-git: github.com/go-git/go-git/v5: go-git: Unauthorized file modification via directory traversal in reference names

SUSE-SU-2026:4286-1 — Security update for amazon-ssm-agent

Security update for amazon-ssm-agent

UBUNTU-CVE-2026-71557

Affected: Ubuntu:Pro:22.04:LTS: golang-github-go-git-go-git, Ubuntu:Pro:24.04:LTS: golang-github-go-git-go-git, Ubuntu:Pro:26.04:LTS: golang-github-go-git-go-git