CVE-2026-34165: go-git: Maliciously crafted idx file can cause asymmetric memory consumption

Vulnerability summary

CVE-2026-34165 is a medium (CVSS 5.0) Integer Underflow (Wrap or Wraparound) vulnerability in go-git_project go-git. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 4.4% of scored vulnerabilities.

Timeline

1. 31-03-2026
   PublishedVulnerability first disclosed.
2. 02-04-2026
   Last modifiedVulnerability information updated.

Description

go-git is an extensible git implementation library written in pure Go. From version 5.0.0 to before version 5.17.1, a vulnerability has been identified in which a maliciously crafted .idx file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a denial-of-service (DoS) condition. Exploitation requires write access to the local repository's .git directory, it order to create or alter existing .idx files. This issue has been patched in version 5.17.1.

• CWE-191Integer Underflow (Wrap or Wraparound)The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.