CVE-2026-33762

Name of the Vulnerable Software and Affected Versions go-git versions prior to 5.17.1

Description The go-git library’s index decoder for Git index format version 4 does not properly validate the path name prefix length before applying it to the previously decoded path name. A specially crafted index file can cause an out-of-bounds slice operation, leading to a runtime panic during index parsing. This issue only affects Git index format version 4. An attacker with the ability to modify or inject a Git index file within a local repository can cause applications using go-git to terminate, resulting in a denial-of-service (DoS) condition.

Recommendations Upgrade to version 5.17.1, or the latest version 6.