Go/github.com/go-git/go-git/v5 CVE-2026-45022: high 7.5, EPSS 0.16%

go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git

Action: Upgrade github.com/go-git/go-git/v5 to 5.19.0 or later.

go get github.com/go-git/go-git/v5@v5.19.0

Affected

Fixed versions

Sources

• osv: GHSA-389r-gv7p-r3rp#Go/github.com/go-git/go-git/v5
• nvd: CVE-2026-45022
• https://github.com/go-git/go-git/security/advisories/GHSA-389r-gv7p-r3rp
• https://github.com/go-git/go-git

CVE-2026-45022 · published 2026-05-11T14:48:12Z · modified 2026-09-10T03:51:04.377050417Z · JSON