USN-8088-1: golang-github-go-git-go-git Ubuntu

Published

Published 12-03-2026Last modified 27-04-2026

Vulnerability summary

USN-8088-1 is a vulnerability in golang-github-go-git-go-git Ubuntu with no CVSS score yet.

Priority

Insufficient evidence

No CVSS vector published; no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

Not scored

010

No CVSS score recorded

EPSS scoreNot scoredRisk metrics not yet published.

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 5 · Downstream 0 · Related 5

CVE-2023-49568 CVE-2023-49569 CVE-2025-21613 CVE-2025-21614 CVE-2026-25934

Timeline

12-03-2026
PublishedVulnerability first disclosed.
27-04-2026
Last modifiedVulnerability information updated.

Description

golang-github-go-git-go-git vulnerabilities Ionut Lalu discovered that go-git incorrectly handled certain specially crafted Git server responses. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-49568, CVE-2025-21614) Ionut Lalu discovered that go-git incorrectly handled file system paths when using the ChrootOS implementation. A remote attacker could possibly use this issue to perform a path traversal and create or modify arbitrary files, leading to remote code execution. (CVE-2023-49569) It was discovered that go-git did not properly sanitize arguments when invoking git-upload-pack using the file transport protocol. An attacker could possibly use this issue to inject arbitrary flag values when interacting with local Git repositories. (CVE-2025-21613) It was discovered that go-git did not properly verify integrity checks for pack and index files. An attacker could possibly use this issue to cause go-git to process corrupted repository data, resulting in unexpected errors or an incorrect repository state. (CVE-2026-25934)