CVE-2026-34165

mediumPriorität · verfolgen · 0EPSS 0.001 · 4. PerzentilDEEUFRRUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.15% (4th) EPSS

CVSS 5 · medium

Is it mine?

32 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

go-git is an extensible git implementation library written in pure Go. From version 5.0.0 to before version 5.17.1, a vulnerability has been identified in which a maliciously crafted .idx file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a denial-of-service (DoS) condition. Exploitation requires write access to the local repository's .git directory, it order to create or alter existing .idx files. This issue has been patched in version 5.17.1.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobensteampipe-0:2.4.1-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobensteampipe-0:2.4.1-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobensteampipe-0:2.4.1-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobensteampipe-0:2.4.1-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

5.0

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.15mediumAV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.15mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.15mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:Hsecondary · security-advisories@github.comAusnutzbarkeit 1.3 · Auswirkung 3.6

v3.15mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:Hsecondary · OSV

v3.14.6mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-191USCWE-191USCWE-191USCWE-770USCWE-770USCWE-770US

betroffene Produkte (32)

Betroffene Produkte und Versionsbereiche.

go-git go-git5.0.0, → 5.17.1enisa_euvdEU
GitHub Inc go-git5.0.0 → 5.17.1fstec_bduRU
Red Hat Inc. Assisted Installer for Red Hat OpenShift Container Platform≤ 2fstec_bduRU
Red Hat Inc. Builds for Red Hat OpenShiftalle Versionenfstec_bduRU
Red Hat Inc. Confidential Compute Attestationalle Versionenfstec_bduRU
Red Hat Inc. External Secrets Operator for Red Hat OpenShiftalle Versionenfstec_bduRU
Red Hat Inc. Kernel Module Management Operator for Red Hat Openshiftalle Versionenfstec_bduRU
Red Hat Inc. Logging subsystem for Red Hat OpenShiftalle Versionenfstec_bduRU
Red Hat Inc. Machine Deletion Remediation Operatoralle Versionenfstec_bduRU
Red Hat Inc. Migration Toolkit for Containersalle Versionenfstec_bduRU
Red Hat Inc. Migration Toolkit for Virtualizationalle Versionenfstec_bduRU
Red Hat Inc. OpenShift Container Platform≤ 4fstec_bduRU
Red Hat Inc. OpenShift Developer Tools and Servicesalle Versionenfstec_bduRU
Red Hat Inc. OpenShift Pipelinesalle Versionenfstec_bduRU
Red Hat Inc. OpenShift Serverlessalle Versionenfstec_bduRU
Red Hat Inc. Openshift Service Mesh≤ 3fstec_bduRU
Red Hat Inc. Openshift Service Mesh≤ 2fstec_bduRU
Red Hat Inc. Pen Drive Powered by Red Hat Lightspeedalle Versionenfstec_bduRU
Red Hat Inc. Red Hat AI Inference Serveralle Versionenfstec_bduRU
Red Hat Inc. Red Hat Advanced Cluster Management for Kubernetes 2alle Versionenfstec_bduRU

20 von 32 angezeigt

Advisories (4)

Hersteller- und Ökosystem-Meldungen dazu.

openSUSE-SU-2026:10509-1steampipe-2.4.1-1.1 on GA media2026-04-08csaf · suse_csafDE
steampipe-2.4.1-1.1 on GA media
GHSA-jhf3-xxhw-2wppgo-git: Maliciously crafted idx file can cause asymmetric memory consumption2026-03-30ghsa · osvUS
### Impact A vulnerability has been identified in which a maliciously crafted `.idx` file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a Denial of Service (DoS) condition. Exploitation requires write access to the local repository's `.git` directory, it order to create or alter existing `.idx` files. ### Patches Users should upgrade to `v5.17.1`, or the latest `v6` [pseudo-version](https://go.dev/ref/mod#pseudo-versions), in order to mitigate this vulnerability. ### Credit The go-git maintainers thank @kq5y for finding and reporting this issue privately to the `go-git` project.
CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
GO-2026-4910Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git2026-04-07vendor · osvUS
Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu osv suse_csaf certfr NVD CVE.org MITRE

veröffentlicht 2026-03-31geändert 2026-08-05

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan