What is the CVSS score of CVE-2026-25934?

CVE-2026-25934 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Go Git are affected by CVE-2026-25934?

Organizations using pure Go. should be aware of moderate risk from CVE-2026-25934 rated CVSS 4.3. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-25934?

Within 30 days: Identify affected systems running pure Go. and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Go Git CVE-2026-25934

MEDIUM

Improper Validation of Integrity Check Value (CWE-354)

2026-02-09 security-advisories@github.com

GHSA-37cx-329c-33x3

Information Disclosure Go Git Red Hat Suse

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Feb 20, 2026 - 20:21 nvd

Patch available

CVE Published

Feb 09, 2026 - 23:16 nvd

MEDIUM 4.3

DescriptionGitHub Advisory

go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.

AnalysisAI

Corrupted Git pack and index files are not properly validated in go-git versions before 5.16.5, allowing an attacker to supply malicious packfiles that bypass integrity checks and cause go-git to consume corrupted data. This can result in unexpected application errors and denial of service conditions for any system using the vulnerable go-git library to fetch or process Git repositories. The vulnerability requires user interaction to fetch from a malicious or compromised Git source.

Technical ContextAI

Affects Go-Git. go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform inte

RemediationAI

A vendor patch is available — apply it immediately. Fixed in version 5.16.5.. Restrict network access to the affected service where possible.

More in Go Git

View all

CVE-2023-49569 CRITICAL Act Now

9.8 Jan 12

A path traversal vulnerability was discovered in go-git versions prior to v5.11. Rated critical severity (CVSS 9.8), thi

CVE-2023-49568 HIGH This Week

7.5 Jan 12

A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. Rated high severity (CVSS 7.5)

CVE-2025-21614 HIGH This Month

7.5 Jan 06

go-git is a highly extensible git implementation library written in pure Go. Rated high severity (CVSS 7.5), this vulner

CVE-2025-21613 CRITICAL This Week

9.2 Jan 06

go-git is a highly extensible git implementation library written in pure Go. Rated critical severity (CVSS 9.2), this vu

Same weakness CWE-354 – Improper Validation of Integrity Check Value

View all

CVE-2023-48795 MEDIUM POC

5.9

CVE-2024-3596 CRITICAL

9.0

CVE-2023-33668 CRITICAL POC

9.8

CVE-2026-50021 HIGH POC

8.1

CVE-2022-36174 HIGH POC

8.1

CVE-2019-13496 HIGH POC

8.1

CVE-2024-51141 HIGH POC

7.8

CVE-2023-38802 HIGH POC

7.5

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2017-0213 HIGH POC

7.3

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
SUSE Linux Enterprise Module for Public Cloud 15 SP4	Affected
SUSE Linux Enterprise Server 15 SP4	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP4	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4	Affected
SUSE Manager Server 4.3	Affected

CVE-2026-25934 vulnerability details – vuln.today

Back

Go Git CVE-2026-25934

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in Go Git

Same weakness CWE-354 – Improper Validation of Integrity Check Value

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code