EUVD-2026-6247Published

go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-gi…

Historical advisory saved 28 Oct 2026 02:11:35 UTC. The publisher may have updated it since then. Latest advisory.

euvd · EUVD-2026-6247

Published

go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.

Additional publisher context

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Feb 9, 2026, 10:13:41 PM

dateUpdated: Feb 11, 2026, 9:23:14 PM

11 related source bulletins · separate from aliases

RHSA-2026:37387: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update

CVE-2024-25621 · CVE-2024-40635 · CVE-2024-45310 · CVE-2025-8766 · CVE-2025-21613 · CVE-2025-21614 · CVE-2025-22870 · CVE-2025-47911 · CVE-2025-52881 · CVE-2025-54410 · CVE-2025-58058 · CVE-2025-64329 · CVE-2025-66506 · CVE-2026-22772 · CVE-2026-23831 · CVE-2026-24117 · CVE-2026-25680 · CVE-2026-25681 · CVE-2026-25934 · CVE-2026-27136 · CVE-2026-27141 · CVE-2026-27903 · CVE-2026-33540 · CVE-2026-33747 · CVE-2026-33748 · CVE-2026-33814 · CVE-2026-34986 · CVE-2026-35172 · CVE-2026-35469 · CVE-2026-39821 · CVE-2026-39827 · CVE-2026-39828 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-39831 · CVE-2026-39832 · CVE-2026-39833 · CVE-2026-39834 · CVE-2026-39835 · CVE-2026-39883 · CVE-2026-41506 · CVE-2026-41567 · CVE-2026-41568 · CVE-2026-42502 · CVE-2026-42506 · CVE-2026-42508 · CVE-2026-44740 · CVE-2026-45571 · CVE-2026-46595 · CVE-2026-46597 · CVE-2026-46598

openSUSE-SU-2026:11694-1: amazon-ssm-agent-3.3.5226.0-1.1 on GA media

CVE-2025-22869 · CVE-2026-25934 · CVE-2026-71556

SUSE-SU-2026:22157-1: Security update for amazon-ssm-agent

CVE-2025-22869 · CVE-2025-22870 · CVE-2025-47913 · CVE-2026-1229 · CVE-2026-25934 · CVE-2026-39821 · CVE-2026-39827 · CVE-2026-39828 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-39831 · CVE-2026-39832 · CVE-2026-39833 · CVE-2026-39834 · CVE-2026-39835 · CVE-2026-41506 · CVE-2026-42508 · CVE-2026-44740 · CVE-2026-46595 · CVE-2026-46597 · CVE-2026-46598

openSUSE-SU-2026:20809-1: Security update for trivy

CVE-2025-64702 · CVE-2025-69725 · CVE-2026-25934 · CVE-2026-33186 · CVE-2026-33747 · CVE-2026-33748 · CVE-2026-34986 · CVE-2026-39984 · CVE-2026-41506

SUSE-SU-2026:2468-1: Security update for amazon-ssm-agent

SUSE-SU-2026:1411-1: Security update for terraform-provider-local, terraform-provider-random, terraform-provider-tls

CVE-2026-25934 · CVE-2026-33186

SUSE-SU-2026:21793-1: Security update for alloy

CVE-2026-25934 · CVE-2026-26958 · CVE-2026-33186 · CVE-2026-4427

openSUSE-SU-2026:10618-1: alloy-1.15.1-1.1 on GA media

CVE-2026-25934 · CVE-2026-26958 · CVE-2026-33186

openSUSE-SU-2026:20752-1: Security update for alloy

CVE-2026-25934 · CVE-2026-26958 · CVE-2026-33186 · CVE-2026-4427

openSUSE-SU-2026:10651-1: trivy-0.70.0-1.1 on GA media

CVE-2025-69725 · CVE-2026-25934 · CVE-2026-33186 · CVE-2026-33747 · CVE-2026-33748 · CVE-2026-34986 · CVE-2026-39984

openSUSE-SU-2026:21079-1: Security update for amazon-ssm-agent

Source published: Feb 9, 2026, 10:13:41 PM (timezone not stated)
Source modified: Feb 11, 2026, 9:23:14 PM (timezone not stated)
Saved here: 28 Oct 2026 02:11:35 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

EUVD CVSS 3.1 · 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N