Which versions of go-git are affected by CVE-2026-45022?

A vulnerability in go-git, a development library for Git operations, allows attackers with contributor access to create commits with forged metadata while maintaining valid signatures.. A patch is available.

How to fix or mitigate CVE-2026-45022?

24 hours: Identify all systems using go-git (development environments, CI/CD platforms, automation tools) and catalog current versions. 7 days: Upgrade go-git v5 to 5.19.0 or later; upgrade v6 to builds after 6.0.0-alpha.2. 30 days: Audit and re-validate signatures on commits created with vulnerable go-git versions to detect any forged or spoofed metadata.

go-git CVE-2026-45022

Q: What is the CVSS score of CVE-2026-45022?

CVE-2026-45022 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-32542 HIGH

Incorrect Behavior Order: Validate Before Canonicalize (CWE-180)

2026-05-11 https://github.com/go-git/go-git

GHSA-389r-gv7p-r3rp

Information Disclosure

7.0

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 27, 2026 - 19:43 vuln.today

v3 (cvss_changed)

Analysis Updated

May 27, 2026 - 19:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 27, 2026 - 19:37 vuln.today

cvss_changed

CVSS changed

May 27, 2026 - 19:37 NVD

7.0 (HIGH)

Source Code Evidence Fetched

May 11, 2026 - 15:15 vuln.today

Analysis Generated

May 11, 2026 - 15:15 vuln.today

CVE Published

May 11, 2026 - 14:48 nvd

HIGH

DescriptionGitHub Advisory

Impact

go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-git’s decoded representation may expose values differently from how Git itself would interpret or reject the same object.

Additionally, go-git’s commit signing and verification logic operates over commit data reconstructed from go-git’s parsed representation rather than the original raw object bytes. As a result, go-git may sign or verify a commit payload that is not byte-for-byte equivalent to the object stored in the repository.

This can cause a signature to appear valid for a commit whose displayed or effective metadata differs from the object that was intended to be signed.

Patches

Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-git version.

Credit

Thanks to @bugbunny-research (https://bugbunny.ai/) for reporting this to sigstore/gitsign, and to @wlynch, @patzielinski and @adityasaky for coordinating the disclosure with the go-git project. :bow: :1st_place_medal:

Thanks to @wayphinder for reporting this to the go-git project. :bow:

AnalysisAI

Commit and tag signature confusion in go-git (the pure-Go implementation of Git) lets a crafted Git object carry a signature that validates while its effective metadata differs from what was actually signed. Because go-git parses ambiguous or malformed object headers differently from canonical Git, and because its signing/verification path operates over a reconstructed representation rather than the raw object bytes, an attacker with contributor access can create commits whose displayed author/committer/metadata diverges from the signed payload - undermining downstream trust decisions (the issue was originally surfaced through sigstore/gitsign). Affected releases are go-git v5 before 5.19.0 and v6 alpha builds 6.0.0-alpha.1 through 6.0.0-alpha.2. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was provided in the source data.

Technical ContextAI

go-git is a widely embedded, dependency-free Go library that reads and writes Git repositories, used by tooling such as gitsign, Flux, and various CI/supply-chain systems. Git stores commit and tag objects as text with structured headers (tree, parent, author, committer, gpgsig, etc.) followed by a message; canonical Git applies strict rules about how these headers are ordered, terminated, and rejected. The flaw maps to CWE-180 (Incorrect Behavior Order: Validate Before Canonicalize): go-git decodes the object into an in-memory struct and then reconstructs the byte stream for signing or verification, so the bytes it signs/verifies are not guaranteed to be identical to the bytes stored on disk. When headers are malformed or ambiguous, go-git's parsed view can diverge from how upstream Git would interpret (or reject) the same object, breaking the byte-for-byte invariant that cryptographic commit signatures depend on. The CPE data scopes this to two module major versions, pkg:go/github.com_go-git_go-git_v5 and pkg:go/github.com_go-git_go-git_v6.

RemediationAI

Vendor-released patch: upgrade to go-git v5 5.19.0 or, for the v6 line, 6.0.0-alpha.3 (and abandon unsupported pre-v5 versions entirely). This is a library dependency, so update the module in go.mod, run go get/go mod tidy, and rebuild every service that vendors go-git rather than relying on a system package. No header-level workaround is published; until you can upgrade, the actionable compensating control is to stop treating go-git's commit/tag signature verification as a security boundary - instead verify signatures with canonical git (e.g., shell out to git verify-commit/git verify-tag) or recompute and compare the raw object bytes before trusting a signature, accepting the trade-off of added complexity and a dependency on a git binary. Where go-git is used to verify untrusted, externally contributed repositories, restrict who can push/contribute objects and re-validate critical commits out of band. Track the fix via GHSA-389r-gv7p-r3rp (https://github.com/go-git/go-git/security/advisories/GHSA-389r-gv7p-r3rp).