{"action":"Upgrade github.com/go-git/go-git/v5 to 5.16.5 or later.","affected":[{"fixed":"5.16.5","introduced":"0"}],"component":"github.com/go-git/go-git/v5","cve_ids":["CVE-2026-25934"],"ecosystem":"Go","epss":0.00158,"exploited":false,"fixed_versions":["5.16.5"],"ghsa_id":"GHSA-37cx-329c-33x3","id":"tcs_01M5KETD6SS4A2XSM8Q4Y56ECF","modified_at":"2026-09-10T03:50:59.405841934Z","published_at":"2026-02-10T00:28:53Z","references":["https://osv.dev/vulnerability/GHSA-37cx-329c-33x3","https://github.com/go-git/go-git/security/advisories/GHSA-37cx-329c-33x3","https://nvd.nist.gov/vuln/detail/CVE-2026-25934","https://github.com/go-git/go-git","https://github.com/go-git/go-git/releases/tag/v5.16.5"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-37cx-329c-33x3","url":"https://osv.dev/vulnerability/GHSA-37cx-329c-33x3"}],"summary":"go-git improperly verifies data integrity values for .idx and .pack files"}