GO-2026-5074

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-5074

Import Source

https://vuln.go.dev/ID/GO-2026-5074.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-5074

Aliases

Published

2026-07-24T18:35:55Z

Modified

2026-07-24T19:00:21.469421031Z

Summary

Go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation in github.com/go-git/go-git

Details

Go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation in github.com/go-git/go-git

Database specific

{
    "url": "https://pkg.go.dev/vuln/GO-2026-5074",
    "review_status": "REVIEWED"
}

References

Affected packages

Go / github.com/go-git/go-git/v5

Package

Name: github.com/go-git/go-git/v5; View open source insights on deps.dev
Purl: pkg:golang/github.com/go-git/go-git/v5

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.19.0

Ecosystem specific

{
    "imports": [
        {
            "symbols": [
                "Commit.Decode",
                "Commit.IsAncestor",
                "Commit.MergeBase",
                "Commit.Parent",
                "Commit.Stats",
                "Commit.StatsContext",
                "DecodeCommit",
                "DecodeObject",
                "DecodeTag",
                "GetCommit",
                "GetObject",
                "GetTag",
                "Independents",
                "NewCommitAllIter",
                "ObjectIter.Next",
                "Tag.Commit",
                "Tag.Decode",
                "Tag.Object",
                "Tag.String",
                "Tag.Tree",
                "TagIter.Next",
                "bfsCommitIterator.ForEach",
                "bfsCommitIterator.Next",
                "commitIteratorByCTime.ForEach",
                "commitIteratorByCTime.Next",
                "commitPostIterator.ForEach",
                "commitPostIterator.Next",
                "commitPreIterator.ForEach",
                "commitPreIterator.Next",
                "filterCommitIter.ForEach",
                "filterCommitIter.Next",
                "storerCommitIter.ForEach",
                "storerCommitIter.Next"
            ],
            "path": "github.com/go-git/go-git/v5/plumbing/object"
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5074.json"