CVE-2025-21614

Description

go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.72%• Percentile: 53%

Techniques & Countermeasures

• CWE-400•Uncontrolled Resource Consumption

  The product does not properly control the allocation and maintenance of a limited resource.

Affected Systems

• chainguard•amazon-ssm-agent

  < 3.3.1957.0-r5

• chainguard•amazon-ssm-agent-ecs-exec

  < 3.3.1957.0-r5

• chainguard•apko

  < 0.22.5-r0

• chainguard•argo-cd-2.11

  < 2.11.12-r3

• chainguard•argo-cd-2.13

  < 2.13.3-r1

• chainguard•argo-cd-2.13-compat

  < 2.13.3-r1

• chainguard•argo-cd-2.13-repo-server

  < 2.13.3-r1

• chainguard•argo-events

  < 1.9.3-r3

• chainguard•argo-events-fips

  < 1.9.3-r3

• chainguard•argo-workflows

  < 3.6.2-r4

• chainguard•argo-workflows-fips

  < 3.6.2-r3

• chainguard•argocd-image-updater

  < 0.15.2-r1

• chainguard•argocd-image-updater-compat

  < 0.15.2-r1

• chainguard•argocd-image-updater-fips

  < 0.15.2-r0

• chainguard•bom

  < 0.6.0-r14

• chainguard•chainctl

  < 0.2.20-r0

• chainguard•chezmoi

  < 2.57.0-r1

• chainguard•crossplane-crank

  < 1.18.2-r2

• chainguard•dagger

  < 0.15.1-r3

• chainguard•docker-credential-cgr

  < 0.2.20-r0

• chainguard•flux

  < 2.4.0-r3

• chainguard•flux-fips-2.4

  < 2.4.0-r3

• chainguard•flux-fips-2.4-compat

  < 2.4.0-r3

• chainguard•flux-image-automation-controller

  < 0.39.0-r5

• chainguard•flux-image-automation-controller-compat

  < 0.39.0-r5

• chainguard•flux-image-automation-controller-fips

  < 0.39.0-r3

• chainguard•flux-image-automation-controller-fips-compat

  < 0.39.0-r3

• chainguard•flux-image-automation-controller-iamguarded-compat

  < 0.39.0-r5

• chainguard•flux-kustomize-controller

  < 1.4.0-r4

• chainguard•flux-kustomize-controller-fips

  < 1.4.0-r3

• chainguard•flux-kustomize-controller-iamguarded-compat

  < 1.4.0-r4

• chainguard•flux-source-controller

  < 1.4.1-r6

• chainguard•flux-source-controller-fips

  < 1.4.1-r4

• chainguard•flux-source-controller-iamguarded-compat

  < 1.4.1-r6

• chainguard•gitea

  < 1.22.6-r2

• chainguard•gitea-compat

  < 1.22.6-r2

• chainguard•gitea-fips

  < 1.22.6-r2

• chainguard•gitea-fips-compat

  < 1.22.6-r2

• chainguard•gitsign

  < 0.12.0-r1

• chainguard•gitsign-config

  < 0.12.0-r1

• chainguard•gitsign-credential-cache

  < 0.12.0-r1

• chainguard•go-licenses

  < 1.6.0-r20

• chainguard•goreleaser

  < 2.5.1-r1

• chainguard•gptscript

  < 0.9.5-r4

• chainguard•grafana-alloy

  < 1.5.1-r3

• chainguard•grafana-alloy-fips

  < 1.5.1-r3

• chainguard•grype

  < 0.86.1-r2

• chainguard•guac

  < 0.12.4-r1

• chainguard•guaccsub

  < 0.12.4-r1

• chainguard•guacgql

  < 0.12.4-r1

Showing first 50 affected entries in server-rendered view.

References (5)

• https://github.com/go-git/go-git/security/advisories/GHSA-r9px-m959-cxf4
• https://nvd.nist.gov/vuln/detail/CVE-2025-21614
• https://github.com/go-git/go-git
• https://security-tracker.debian.org/tracker/CVE-2025-21614
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21614.json