CVE-2025-21614: go-git clients vulnerable to DoS via maliciously crafted Git server replies

Analyzed

AliasesUBUNTU-CVE-2025-21614DEBIAN-CVE-2025-21614CGA-24hv-hhrh-f6h9+322 more

Published 06-01-2025Last modified 26-08-2025

Vulnerability summary

CVE-2025-21614 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in go-git_project go-git. EPSS estimates a 0.72% chance of exploitation in the next 30 days, higher than 53.8% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.72%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10 · Related 74

OPENSUSE-SU-2025:0056-1 OPENSUSE-SU-2025:14624-1 OPENSUSE-SU-2025:14634-1 OPENSUSE-SU-2025:15487-1 OPENSUSE-SU-2025:20117-1 OPENSUSE-SU-2025:20177-1+68 more

Timeline

06-01-2025
PublishedVulnerability first disclosed.
26-08-2025
Last modifiedVulnerability information updated.

Description

go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.

CVSS metrics

7 scores · 7 sources · 1 version

v3.17.5

EPSS trend

Probability

0.72%

Chance of exploitation in the next 30 days

Percentile

54%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.72% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard161 products

amazon-ssm-agent< 3.3.1957.0-r5
amazon-ssm-agent-ecs-exec< 3.3.1957.0-r5
apko< 0.22.5-r0
argo-cd-2.11< 2.11.12-r3
argo-cd-2.13< 2.13.3-r1

argo-cd-2.13-compat< 2.13.3-r1
argo-cd-2.13-repo-server< 2.13.3-r1
argo-events< 1.9.3-r3
argo-events-fips< 1.9.3-r3
argo-workflows< 3.6.2-r4
argo-workflows-fips< 3.6.2-r3
argocd-image-updater< 0.15.2-r1
argocd-image-updater-compat< 0.15.2-r1
argocd-image-updater-fips< 0.15.2-r0
bom< 0.6.0-r14
chainctl< 0.2.20-r0
chezmoi< 2.57.0-r1
crossplane-crank< 1.18.2-r2
dagger< 0.15.1-r3
docker-credential-cgr< 0.2.20-r0
flux< 2.4.0-r3
flux-fips-2.4< 2.4.0-r3
flux-fips-2.4-compat< 2.4.0-r3
flux-image-automation-controller< 0.39.0-r5
flux-image-automation-controller-compat< 0.39.0-r5
flux-image-automation-controller-fips< 0.39.0-r3
flux-image-automation-controller-fips-compat< 0.39.0-r3
flux-image-automation-controller-iamguarded-compat< 0.39.0-r5
flux-kustomize-controller< 1.4.0-r4
flux-kustomize-controller-fips< 1.4.0-r3
flux-kustomize-controller-iamguarded-compat< 1.4.0-r4
flux-source-controller< 1.4.1-r6
flux-source-controller-fips< 1.4.1-r4
flux-source-controller-iamguarded-compat< 1.4.1-r6
gitea< 1.22.6-r2
gitea-compat< 1.22.6-r2
gitea-fips< 1.22.6-r2
gitea-fips-compat< 1.22.6-r2
gitsign< 0.12.0-r1
gitsign-config< 0.12.0-r1
gitsign-credential-cache< 0.12.0-r1
go-licenses< 1.6.0-r20
goreleaser< 2.5.1-r1
gptscript< 0.9.5-r4
grafana-alloy< 1.5.1-r3
grafana-alloy-fips< 1.5.1-r3
grype< 0.86.1-r2
guac< 0.12.4-r1
guaccsub< 0.12.4-r1
guacgql< 0.12.4-r1
guacingest< 0.12.4-r1
guacone< 0.12.4-r1
k8sgpt< 0.3.48-r3
k9s< 0.32.7-r3
kaniko< 1.23.2-r8
kaniko-compat< 1.23.2-r8
kaniko-fips< 1.23.2-r4
kaniko-warmer< 1.23.2-r8
kaniko-warmer-compat< 1.23.2-r8
kaniko-warmer-fips< 1.23.2-r4
kargo< 1.1.2-r1
kargo-oci-compat< 1.1.2-r1
kots< 1.123.0-r1
kots-compat< 1.123.0-r1
kots-symlink-compat< 1.123.0-r1
kubescape< 3.0.22-r3
kubevela< 1.9.13-r6
kubevela-vela-cli< 1.9.13-r6
kubevela-vela-core< 1.9.13-r6
kubevela-vela-core-compat< 1.9.13-r6
kyverno-1.13< 1.13.2-r3
kyverno-background-controller-1.13< 1.13.2-r3
kyverno-background-controller-fips-1.13< 1.13.2-r3
kyverno-cleanup-controller-1.13< 1.13.2-r3
kyverno-cleanup-controller-fips-1.13< 1.13.2-r3
kyverno-cli-1.13< 1.13.2-r3
kyverno-cli-fips-1.13< 1.13.2-r3
kyverno-fips-1.13< 1.13.2-r3
kyverno-init-container-1.13< 1.13.2-r3
kyverno-init-container-fips-1.13< 1.13.2-r3
kyverno-reports-controller-1.13< 1.13.2-r3
kyverno-reports-controller-fips-1.13< 1.13.2-r3
melange< 0.18.3-r1
nemo< 1.23.0-r7
nuclei< 3.3.7-r3
osv-scanner< 1.9.2-r1
packer< 1.11.2-r3
packer-fips< 1.11.2-r3
pulumi< 3.145.0-r0
pulumi-kubernetes-operator< 1.16.0-r6
pulumi-language-dotnet< 3.71.1-r2
pulumi-language-go< 3.145.0-r0
pulumi-language-java< 1.6.0-r1
pulumi-language-nodejs< 3.145.0-r0
pulumi-language-python< 3.145.0-r0
pulumi-language-yaml< 1.13.0-r3
scorecard< 5.0.0-r5
skaffold< 2.13.2-r5
snyk-cli< 1.1294.3-r2
src-fingerprint< 0.19.0-r21
src-fingerprint-fips< 0.19.0-r7
syft< 1.18.1-r2
task< 3.40.1-r3
tekton-pipelines-0.59< 0.59.6-r2
tekton-pipelines-0.62< 0.62.9-r2
tekton-pipelines-0.65< 0.65.7-r2
tekton-pipelines-controller-0.59< 0.59.6-r2
tekton-pipelines-controller-0.59-compat< 0.59.6-r2
tekton-pipelines-controller-0.62< 0.62.9-r2
tekton-pipelines-controller-0.62-compat< 0.62.9-r2
tekton-pipelines-controller-0.65< 0.65.7-r2
tekton-pipelines-controller-0.65-compat< 0.65.7-r2
tekton-pipelines-entrypoint-0.59< 0.59.6-r2
tekton-pipelines-entrypoint-0.59-compat< 0.59.6-r2
tekton-pipelines-entrypoint-0.62< 0.62.9-r2
tekton-pipelines-entrypoint-0.62-compat< 0.62.9-r2
tekton-pipelines-entrypoint-0.65< 0.65.7-r2
tekton-pipelines-entrypoint-0.65-compat< 0.65.7-r2
tekton-pipelines-events-0.59< 0.59.6-r2
tekton-pipelines-events-0.59-compat< 0.59.6-r2
tekton-pipelines-events-0.62< 0.62.9-r2
tekton-pipelines-events-0.62-compat< 0.62.9-r2
tekton-pipelines-events-0.65< 0.65.7-r2
tekton-pipelines-events-0.65-compat< 0.65.7-r2
tekton-pipelines-nop-0.59< 0.59.6-r2
tekton-pipelines-nop-0.59-compat< 0.59.6-r2
tekton-pipelines-nop-0.62< 0.62.9-r2
tekton-pipelines-nop-0.62-compat< 0.62.9-r2
tekton-pipelines-nop-0.65< 0.65.7-r2
tekton-pipelines-nop-0.65-compat< 0.65.7-r2
tekton-pipelines-resolvers-0.59< 0.59.6-r2
tekton-pipelines-resolvers-0.59-compat< 0.59.6-r2
tekton-pipelines-resolvers-0.62< 0.62.9-r2
tekton-pipelines-resolvers-0.62-compat< 0.62.9-r2
tekton-pipelines-resolvers-0.65< 0.65.7-r2
tekton-pipelines-resolvers-0.65-compat< 0.65.7-r2
tekton-pipelines-sidecarlogresults-0.59< 0.59.6-r2
tekton-pipelines-sidecarlogresults-0.59-compat< 0.59.6-r2
tekton-pipelines-sidecarlogresults-0.62< 0.62.9-r2
tekton-pipelines-sidecarlogresults-0.62-compat< 0.62.9-r2
tekton-pipelines-sidecarlogresults-0.65< 0.65.7-r2
tekton-pipelines-sidecarlogresults-0.65-compat< 0.65.7-r2
tekton-pipelines-webhook-0.59< 0.59.6-r2
tekton-pipelines-webhook-0.59-compat< 0.59.6-r2
tekton-pipelines-webhook-0.62< 0.62.9-r2
tekton-pipelines-webhook-0.62-compat< 0.62.9-r2
tekton-pipelines-webhook-0.65< 0.65.7-r2
tekton-pipelines-webhook-0.65-compat< 0.65.7-r2
tekton-pipelines-workingdirinit-0.59< 0.59.6-r2
tekton-pipelines-workingdirinit-0.59-compat< 0.59.6-r2
tekton-pipelines-workingdirinit-0.62< 0.62.9-r2
tekton-pipelines-workingdirinit-0.62-compat< 0.62.9-r2
tekton-pipelines-workingdirinit-0.65< 0.65.7-r2
tekton-pipelines-workingdirinit-0.65-compat< 0.65.7-r2
tfsec< 1.28.12-r1
timoni< 0.23.0-r3
trivy< 0.58.1-r1
trivy-fips< 0.58.2-r0
wolfictl< 0.27.5-r0
zarf< 0.45.0-r3
zot< 2.1.1-r8

Show all 161

Wolfi39 products

apko< 0.22.5-r0
argo-events< 1.9.3-r3
argo-workflows< 3.6.2-r4
argocd-image-updater< 0.15.2-r1
argocd-image-updater-compat< 0.15.2-r1

Show all 39

2 vendors · 200 products · Showing 200 of 240

References

8 links

github.com/go-git/go-git/security/advisories/GHSA-r9px-m959-cxf4X Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
ubuntu.com/security/CVE-2025-21614REPORT
www.cve.org/CVERecord?id=CVE-2025-21614REPORT
ubuntu.com/security/notices/USN-8088-1Advisory
security-tracker.debian.org/tracker/CVE-2025-21614Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21614.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2025-21614AdvisoryOval
github.com/go-git/go-gitPACKAGE