CVE-2025-21614 — go-git clients vulnerable to DoS via maliciously crafted Git server replies

CVE-2025-21614

go-git clients vulnerable to DoS via maliciously crafted Git server replies PUBLISHED

Description (CNA)

go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.

Affected (CNA)

Vendor / product	Versions
go-git / go-git	affected >= 4.0.0, < 5.13.0

CWE

CWE-400

References

https://github.com/go-git/go-git/security/advisories/GHSA-r9px-m959-cxf4

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.