go-git up to 5.18.x/6.0.0-alpha.2 validate before canonicalize

Summaryinfo

A vulnerability described as problematic has been identified in go-git up to 5.18.x/6.0.0-alpha.2. This impacts an unknown function. Executing a manipulation can lead to validate before canonicalize. The identification of this vulnerability is CVE-2026-45022. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic was found in go-git up to 5.18.x/6.0.0-alpha.2. This vulnerability affects an unknown code block. The manipulation with an unknown input leads to a validate before canonicalize vulnerability. The CWE definition for the vulnerability is CWE-180. The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step. As an impact it is known to affect integrity. CVE summarizes:

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-git’s decoded representation may expose values differently from how Git itself would interpret or reject the same object. Additionally, go-git’s commit signing and verification logic operates over commit data reconstructed from go-git’s parsed representation rather than the original raw object bytes. As a result, go-git may sign or verify a commit payload that is not byte-for-byte equivalent to the object stored in the repository. This can cause a signature to appear valid for a commit whose displayed or effective metadata differs from the object that was intended to be signed. This vulnerability is fixed in 5.19.0 and 6.0.0-alpha.3.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-45022 since 05/08/2026. The exploitation appears to be difficult. The attack can be initiated remotely. There are neither technical details nor an exploit publicly available.

Upgrading to version 5.19.0 or 6.0.0-alpha.3 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Versioning Software

Name

• go-git

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.5
• 5.6
• 5.7
• 5.8
• 5.9
• 5.10
• 5.11
• 5.12
• 5.13
• 5.14
• 5.15
• 5.16
• 5.17
• 5.18
• 6.0.0-alpha.0
• 6.0.0-alpha.1
• 6.0.0-alpha.2

Website

• Product: https://github.com/go-git/go-git/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion