{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"github.com/go-git/go-git","cve_ids":["CVE-2026-25934"],"ecosystem":"Go","epss":0.00158,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-37cx-329c-33x3","id":"tcs_01M5KGDXMAQA649BP2XT6P2QWB","modified_at":"2026-02-20T20:43:58.744703Z","published_at":"2026-02-19T17:28:55Z","references":["https://osv.dev/vulnerability/GO-2026-4473","https://github.com/go-git/go-git/security/advisories/GHSA-37cx-329c-33x3","https://github.com/go-git/go-git/releases/tag/v5.16.5"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-4473","url":"https://osv.dev/vulnerability/GO-2026-4473"}],"summary":"Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git"}