CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-45022

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-git’s decoded representation may expose values differently from how Git itself would interpret or reject the same object. Additionally, go-git’s commit signing and verification logic operates over commit data reconstructed from go-git’s parsed representation rather than the original raw object bytes. As a result, go-git may sign or verify a commit payload that is not byte-for-byte equivalent to the object stored in the repository. This can cause a signature to appear valid for a commit whose displayed or effective metadata differs from the object that was intended to be signed. This vulnerability is fixed in 5.19.0 and 6.0.0-alpha.3.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.0

EPSS Ranking 0.4%

CVSS Severity

CVSS v3 Score 7.5

References

https://github.com/go-git/go-git/security/advisories/GHSA-389r-gv7p-r3rp

Products affected by CVE-2026-45022

Go-Git Project » Go-Git » Version: 1.0.0

cpe:2.3:a:go-git_project:go-git:1.0.0
Go-Git Project » Go-Git » Version: 2.0.0

cpe:2.3:a:go-git_project:go-git:2.0.0
Go-Git Project » Go-Git » Version: 2.1.0

cpe:2.3:a:go-git_project:go-git:2.1.0
Go-Git Project » Go-Git » Version: 2.1.1

cpe:2.3:a:go-git_project:go-git:2.1.1
Go-Git Project » Go-Git » Version: 2.1.2

cpe:2.3:a:go-git_project:go-git:2.1.2
Go-Git Project » Go-Git » Version: 2.1.3

cpe:2.3:a:go-git_project:go-git:2.1.3
Go-Git Project » Go-Git » Version: 2.2.0

cpe:2.3:a:go-git_project:go-git:2.2.0
Go-Git Project » Go-Git » Version: 2.2.1

cpe:2.3:a:go-git_project:go-git:2.2.1
Go-Git Project » Go-Git » Version: 3.0.0

cpe:2.3:a:go-git_project:go-git:3.0.0
Go-Git Project » Go-Git » Version: 3.0.1

cpe:2.3:a:go-git_project:go-git:3.0.1
Go-Git Project » Go-Git » Version: 3.0.2

cpe:2.3:a:go-git_project:go-git:3.0.2
Go-Git Project » Go-Git » Version: 3.0.3

cpe:2.3:a:go-git_project:go-git:3.0.3
Go-Git Project » Go-Git » Version: 3.0.4

cpe:2.3:a:go-git_project:go-git:3.0.4
Go-Git Project » Go-Git » Version: 3.1.0

cpe:2.3:a:go-git_project:go-git:3.1.0
Go-Git Project » Go-Git » Version: 3.1.1

cpe:2.3:a:go-git_project:go-git:3.1.1
Go-Git Project » Go-Git » Version: 3.2.0

cpe:2.3:a:go-git_project:go-git:3.2.0
Go-Git Project » Go-Git » Version: 4.0.0

cpe:2.3:a:go-git_project:go-git:4.0.0
Go-Git Project » Go-Git » Version: 4.1.0

cpe:2.3:a:go-git_project:go-git:4.1.0
Go-Git Project » Go-Git » Version: 4.1.1

cpe:2.3:a:go-git_project:go-git:4.1.1
Go-Git Project » Go-Git » Version: 4.10.0

cpe:2.3:a:go-git_project:go-git:4.10.0
Go-Git Project » Go-Git » Version: 4.11.0

cpe:2.3:a:go-git_project:go-git:4.11.0
Go-Git Project » Go-Git » Version: 4.12.0

cpe:2.3:a:go-git_project:go-git:4.12.0
Go-Git Project » Go-Git » Version: 4.13.0

cpe:2.3:a:go-git_project:go-git:4.13.0
Go-Git Project » Go-Git » Version: 4.13.1

cpe:2.3:a:go-git_project:go-git:4.13.1
Go-Git Project » Go-Git » Version: 4.2.0

cpe:2.3:a:go-git_project:go-git:4.2.0
Go-Git Project » Go-Git » Version: 4.2.1

cpe:2.3:a:go-git_project:go-git:4.2.1
Go-Git Project » Go-Git » Version: 4.3.0

cpe:2.3:a:go-git_project:go-git:4.3.0
Go-Git Project » Go-Git » Version: 4.3.1

cpe:2.3:a:go-git_project:go-git:4.3.1
Go-Git Project » Go-Git » Version: 4.4.0

cpe:2.3:a:go-git_project:go-git:4.4.0
Go-Git Project » Go-Git » Version: 4.4.1

cpe:2.3:a:go-git_project:go-git:4.4.1
Go-Git Project » Go-Git » Version: 4.5.0

cpe:2.3:a:go-git_project:go-git:4.5.0
Go-Git Project » Go-Git » Version: 4.6.0

cpe:2.3:a:go-git_project:go-git:4.6.0
Go-Git Project » Go-Git » Version: 4.7.0

cpe:2.3:a:go-git_project:go-git:4.7.0
Go-Git Project » Go-Git » Version: 4.7.1

cpe:2.3:a:go-git_project:go-git:4.7.1
Go-Git Project » Go-Git » Version: 4.8.0

cpe:2.3:a:go-git_project:go-git:4.8.0
Go-Git Project » Go-Git » Version: 4.8.1

cpe:2.3:a:go-git_project:go-git:4.8.1
Go-Git Project » Go-Git » Version: 4.9.0

cpe:2.3:a:go-git_project:go-git:4.9.0
Go-Git Project » Go-Git » Version: 4.9.1

cpe:2.3:a:go-git_project:go-git:4.9.1
Go-Git Project » Go-Git » Version: 5.0.0

cpe:2.3:a:go-git_project:go-git:5.0.0
Go-Git Project » Go-Git » Version: 5.1.0

cpe:2.3:a:go-git_project:go-git:5.1.0
Go-Git Project » Go-Git » Version: 5.10.0

cpe:2.3:a:go-git_project:go-git:5.10.0
Go-Git Project » Go-Git » Version: 5.10.1

cpe:2.3:a:go-git_project:go-git:5.10.1
Go-Git Project » Go-Git » Version: 5.11.0

cpe:2.3:a:go-git_project:go-git:5.11.0
Go-Git Project » Go-Git » Version: 5.13.0

cpe:2.3:a:go-git_project:go-git:5.13.0
Go-Git Project » Go-Git » Version: 5.13.1

cpe:2.3:a:go-git_project:go-git:5.13.1
Go-Git Project » Go-Git » Version: 5.13.2

cpe:2.3:a:go-git_project:go-git:5.13.2
Go-Git Project » Go-Git » Version: 5.14.0

cpe:2.3:a:go-git_project:go-git:5.14.0
Go-Git Project » Go-Git » Version: 5.15.0

cpe:2.3:a:go-git_project:go-git:5.15.0
Go-Git Project » Go-Git » Version: 5.16.0

cpe:2.3:a:go-git_project:go-git:5.16.0
Go-Git Project » Go-Git » Version: 5.16.1

cpe:2.3:a:go-git_project:go-git:5.16.1
Go-Git Project » Go-Git » Version: 5.16.2

cpe:2.3:a:go-git_project:go-git:5.16.2
Go-Git Project » Go-Git » Version: 5.16.3

cpe:2.3:a:go-git_project:go-git:5.16.3
Go-Git Project » Go-Git » Version: 5.16.4

cpe:2.3:a:go-git_project:go-git:5.16.4
Go-Git Project » Go-Git » Version: 5.16.5

cpe:2.3:a:go-git_project:go-git:5.16.5
Go-Git Project » Go-Git » Version: 5.17.0

cpe:2.3:a:go-git_project:go-git:5.17.0
Go-Git Project » Go-Git » Version: 5.17.1

cpe:2.3:a:go-git_project:go-git:5.17.1
Go-Git Project » Go-Git » Version: 5.17.2

cpe:2.3:a:go-git_project:go-git:5.17.2
Go-Git Project » Go-Git » Version: 5.18.0

cpe:2.3:a:go-git_project:go-git:5.18.0
Go-Git Project » Go-Git » Version: 5.2.0

cpe:2.3:a:go-git_project:go-git:5.2.0
Go-Git Project » Go-Git » Version: 5.3.0

cpe:2.3:a:go-git_project:go-git:5.3.0
Go-Git Project » Go-Git » Version: 5.4.0

cpe:2.3:a:go-git_project:go-git:5.4.0
Go-Git Project » Go-Git » Version: 5.4.1

cpe:2.3:a:go-git_project:go-git:5.4.1
Go-Git Project » Go-Git » Version: 5.4.2

cpe:2.3:a:go-git_project:go-git:5.4.2
Go-Git Project » Go-Git » Version: 5.5.0

cpe:2.3:a:go-git_project:go-git:5.5.0
Go-Git Project » Go-Git » Version: 5.5.1

cpe:2.3:a:go-git_project:go-git:5.5.1
Go-Git Project » Go-Git » Version: 5.5.2

cpe:2.3:a:go-git_project:go-git:5.5.2
Go-Git Project » Go-Git » Version: 5.6.0

cpe:2.3:a:go-git_project:go-git:5.6.0
Go-Git Project » Go-Git » Version: 5.6.1

cpe:2.3:a:go-git_project:go-git:5.6.1
Go-Git Project » Go-Git » Version: 5.7.0

cpe:2.3:a:go-git_project:go-git:5.7.0
Go-Git Project » Go-Git » Version: 5.8.0

cpe:2.3:a:go-git_project:go-git:5.8.0
Go-Git Project » Go-Git » Version: 5.8.1

cpe:2.3:a:go-git_project:go-git:5.8.1
Go-Git Project » Go-Git » Version: 5.9.0

cpe:2.3:a:go-git_project:go-git:5.9.0
Go-Git Project » Go-Git » Version: 6.0.0

cpe:2.3:a:go-git_project:go-git:6.0.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-45022

Products

Pricing

Contact Us