CVE-2023-49568

highpriority · track · 30EPSS 0.007 · 53 %ileDEEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.70% (53rd) EPSS

CVSS 7.5 · high

Is it mine?

45 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · osv · cert_bund

EPSS · scored 2026-10-22

A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Applications using only the in-memory filesystem supported by go-git are not affected by this vulnerability. This is a go-git implementation issue and does not affect the upstream git cli.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · cve-requests@bitdefender.comexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-20US

affected products (45)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
IBM App Connect Enterpriseall versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:-
IBM App Connect Enterprise <=11.0.0.25all versionscert_bundDE
IBM App Connect Enterprise <=12.0.11.3all versionscert_bundDE
IBM Business Automation Workflowall versionscert_bundDEcpe:/a:ibm:business_automation_workflow:-
IBM DB2all versionscert_bundDEcpe:/a:ibm:db2:-
IBM DataPower Gateway <10.0.1.18all versionscert_bundDE
IBM DataPower Gateway <10.5.0.10all versionscert_bundDE
IBM DataPower Gateway <10.5.0.15all versionscert_bundDE
IBM DataPower Gateway <10.5.4all versionscert_bundDE
IBM DataPower Gateway <10.6.0.3all versionscert_bundDE
IBM DataPower Gateway <10.6.2all versionscert_bundDE
IBM FlashSystemall versionscert_bundDEcpe:/a:ibm:flashsystem:-
IBM Integration Bus <=10.1.0.3all versionscert_bundDE
IBM MQ 9.0 LTSall versionscert_bundDEcpe:/a:ibm:mq:9.0_lts
IBM MQ 9.1 LTSall versionscert_bundDEcpe:/a:ibm:mq:9.1_lts
IBM MQ 9.2 LTSall versionscert_bundDEcpe:/a:ibm:mq:9.2_lts
IBM MQ 9.3 CDall versionscert_bundDEcpe:/a:ibm:mq:9.3_cd
IBM MQ 9.3 LTSall versionscert_bundDEcpe:/a:ibm:mq:9.3_lts
IBM MQ Operator v2.0.19 LTSall versionscert_bundDEcpe:/a:ibm:mq:operator_v2.0.19_lts

showing 20 of 45

advisories (4)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-0158Red Hat Advanced Cluster Management for Kubernetes: Mehrere SchwachstellenDeutsch2024-01-18csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen im Red Hat Advanced Cluster Management for Kubernetes ausnutzen, um einen Denial of Service Angriff durchzuführen oder beliebigen Code auszuführen.
WID-SEC-W-2024-0521IBM MQ: Mehrere SchwachstellenDeutsch2024-02-29csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM MQ ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.
GHSA-mw99-9chc-xw7rMaliciously crafted Git server replies can cause DoS on go-git clients2023-12-27ghsa · osvUS
### Impact A denial of service (DoS) vulnerability was discovered in go-git versions prior to `v5.11`. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in `go-git` clients. Applications using only the in-memory filesystem supported by `go-git` are not affected by this vulnerability. This is a `go-git` implementation issue and does not affect the upstream `git` cli. ### Patches Users running versions of `go-git` from `v4` and above are recommended to upgrade to `v5.11` in order to mitigate this vulnerability. ### Workarounds In cases where a bump to the latest version of `go-git` is not possible, we recommend limiting its use to only trust-worthy Git servers. ## Credit Thanks to Ionut Lalu for responsibly disclosing this vulnerability to us. ### References - [GHSA-mw99-9chc-xw7r](https://github.com/go-git/go-git/security/advisories/GHSA-mw99-9chc-xw7r)
GO-2024-2466Denial of service in github.com/go-git/go-git/v5 and gopkg.in/src-d/go-git.v42024-01-23vendor · osvUS
Denial of service in github.com/go-git/go-git/v5 and gopkg.in/src-d/go-git.v4

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv cert_bund NVD CVE.org MITRE

published 2024-01-12modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan