No access to your tenant or devices. Every item links to its source. What this means
go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.
Read the publisher's advisorygo-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.
Read the publisher's advisorygo-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.
Read the publisher's advisory### Impact A vulnerability was discovered in `go-git` whereby data integrity values for `.pack` and `.idx` files were not properly verified. This resulted in `go-git` potentially consuming corrupted files, which would likely result in unexpected errors such as `object not found`. For context, clients fetch [`packfiles`](https://git-scm.com/docs/pack-protocol#_packfile_data) from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (`.idx`) are [generated](https://git-scm.com/docs/pack-format) locally by `go-git`, or the `git` cli, when new `.pack` files are received and processed. The integrity checks for both files were not being verified correctly. Note that the lack of verification of the packfile checksum has no impact on the trust relationship between the client and server, which is enforced based on the protocol being used (e.g. TLS in the case of `https://` or known hosts for `ssh://`). In other words, the packfile checksum verification does not provide any security benefits when connecting to a malicious or compromised Git server. ### Patches Users should upgrade to `v5.16.5`, or the latest `v6` [pseudo-version](https://go.dev/ref/mod#pseudo-versions), in order to mitigate this vulnerability. ### Workarounds In case updating to a fixed version of `go-git` is not possible, users can run [git fsck](https://git-scm.com/docs/git-fsck) from the `git` cli to check for data corruption on a given repository. ### Credit Thanks @N0zoM1z0 for finding and reporting this issue privately to the `go-git` project.
Read the publisher's advisoryImproper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git
Read the publisher's advisoryVendor product
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "go-git",
"product": "go-git",
"versions": [
{
"version": "< 5.16.5",
"status": "affected"
}
]
}Original source record · Cite this exact observation · Complete original publisher JSON
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
datePublished: Feb 9, 2026, 10:13:41 PM
dateUpdated: Feb 11, 2026, 9:23:14 PM
RHSA-2026:37387: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update
CVE-2024-25621 · CVE-2024-40635 · CVE-2024-45310 · CVE-2025-8766 · CVE-2025-21613 · CVE-2025-21614 · CVE-2025-22870 · CVE-2025-47911 · CVE-2025-52881 · CVE-2025-54410 · CVE-2025-58058 · CVE-2025-64329 · CVE-2025-66506 · CVE-2026-22772 · CVE-2026-23831 · CVE-2026-24117 · CVE-2026-25680 · CVE-2026-25681 · CVE-2026-25934 · CVE-2026-27136 · CVE-2026-27141 · CVE-2026-27903 · CVE-2026-33540 · CVE-2026-33747 · CVE-2026-33748 · CVE-2026-33814 · CVE-2026-34986 · CVE-2026-35172 · CVE-2026-35469 · CVE-2026-39821 · CVE-2026-39827 · CVE-2026-39828 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-39831 · CVE-2026-39832 · CVE-2026-39833 · CVE-2026-39834 · CVE-2026-39835 · CVE-2026-39883 · CVE-2026-41506 · CVE-2026-41567 · CVE-2026-41568 · CVE-2026-42502 · CVE-2026-42506 · CVE-2026-42508 · CVE-2026-44740 · CVE-2026-45571 · CVE-2026-46595 · CVE-2026-46597 · CVE-2026-46598
openSUSE-SU-2026:11694-1: amazon-ssm-agent-3.3.5226.0-1.1 on GA media
CVE-2025-22869 · CVE-2026-25934 · CVE-2026-71556
SUSE-SU-2026:22157-1: Security update for amazon-ssm-agent
CVE-2025-22869 · CVE-2025-22870 · CVE-2025-47913 · CVE-2026-1229 · CVE-2026-25934 · CVE-2026-39821 · CVE-2026-39827 · CVE-2026-39828 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-39831 · CVE-2026-39832 · CVE-2026-39833 · CVE-2026-39834 · CVE-2026-39835 · CVE-2026-41506 · CVE-2026-42508 · CVE-2026-44740 · CVE-2026-46595 · CVE-2026-46597 · CVE-2026-46598
openSUSE-SU-2026:20809-1: Security update for trivy
CVE-2025-64702 · CVE-2025-69725 · CVE-2026-25934 · CVE-2026-33186 · CVE-2026-33747 · CVE-2026-33748 · CVE-2026-34986 · CVE-2026-39984 · CVE-2026-41506
SUSE-SU-2026:2468-1: Security update for amazon-ssm-agent
CVE-2025-22869 · CVE-2025-22870 · CVE-2025-47913 · CVE-2026-1229 · CVE-2026-25934 · CVE-2026-39821 · CVE-2026-39827 · CVE-2026-39828 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-39831 · CVE-2026-39832 · CVE-2026-39833 · CVE-2026-39834 · CVE-2026-39835 · CVE-2026-41506 · CVE-2026-42508 · CVE-2026-44740 · CVE-2026-46595 · CVE-2026-46597 · CVE-2026-46598
SUSE-SU-2026:1411-1: Security update for terraform-provider-local, terraform-provider-random, terraform-provider-tls
CVE-2026-25934 · CVE-2026-33186
SUSE-SU-2026:21793-1: Security update for alloy
CVE-2026-25934 · CVE-2026-26958 · CVE-2026-33186 · CVE-2026-4427
openSUSE-SU-2026:10618-1: alloy-1.15.1-1.1 on GA media
CVE-2026-25934 · CVE-2026-26958 · CVE-2026-33186
openSUSE-SU-2026:20752-1: Security update for alloy
CVE-2026-25934 · CVE-2026-26958 · CVE-2026-33186 · CVE-2026-4427
openSUSE-SU-2026:10651-1: trivy-0.70.0-1.1 on GA media
CVE-2025-69725 · CVE-2026-25934 · CVE-2026-33186 · CVE-2026-33747 · CVE-2026-33748 · CVE-2026-34986 · CVE-2026-39984
openSUSE-SU-2026:21079-1: Security update for amazon-ssm-agent
CVE-2025-22869 · CVE-2025-22870 · CVE-2025-47913 · CVE-2026-1229 · CVE-2026-25934 · CVE-2026-39821 · CVE-2026-39827 · CVE-2026-39828 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-39831 · CVE-2026-39832 · CVE-2026-39833 · CVE-2026-39834 · CVE-2026-39835 · CVE-2026-41506 · CVE-2026-42508 · CVE-2026-44740 · CVE-2026-46595 · CVE-2026-46597 · CVE-2026-46598
No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.
Original source record · Cite this exact observation · Complete original publisher JSON
NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Analyzed
Weakness classifications: CWE-354
published: 2026-02-09T23:16:05.937
lastModified: 2026-06-17T10:25:27.243
The original JSON retains the logical configuration operators, exclusions and version bounds.
No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.
Original source record · Cite this exact observation · Complete original publisher JSON
Go
SEMVER · introduced 0 → fixed 5.16.5
Original source record · Cite this exact observation · Complete original publisher JSON
Go
SEMVER · introduced 0
Go
SEMVER · introduced 0
Go
SEMVER · introduced 0 → fixed 5.16.5
Original source record · Cite this exact observation · Complete original publisher JSON