Executive Summary

CVE-2026-34165 is a moderate severity vulnerability in the Go package github.com/go-git/go-git/v5, affecting versions from 5.0.0 up to 5.17.0. It involves a maliciously crafted .idx file that causes asymmetric memory consumption, which can exhaust system memory and lead to a denial-of-service (DoS) condition.

Exploitation requires the attacker to have write access to the local repository’s .git directory to create or modify .idx files.

The vulnerability stems from two weaknesses: an integer underflow (CWE-191) causing incorrect subtraction results, and allocation of resources without limits or throttling (CWE-770), allowing excessive memory consumption.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a denial-of-service (DoS) condition by exhausting the available system memory through asymmetric memory consumption triggered by a malicious .idx file.

An attacker with write access to the local repository’s .git directory can exploit this issue to disrupt the normal operation of applications using the affected go-git library.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves verifying the version of the go-git library in use and checking for any suspicious or maliciously crafted .idx files within local git repositories.

Since exploitation requires write access to the local repository's .git directory to create or modify .idx files, monitoring file changes in these directories can help detect potential exploitation attempts.

Commands to assist detection might include:

• Checking the go-git version used by your application or system to ensure it is not between 5.0.0 and 5.17.0 (inclusive).
• Using file integrity monitoring tools or commands such as `find /path/to/repo/.git -name '*.idx' -exec ls -l {} \;` to list .idx files and their modification times.
• Monitoring system memory usage for unusual spikes that could indicate asymmetric memory consumption caused by malicious .idx files.
• Using audit tools like `auditd` to track write access to .git directories.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade the go-git library to version 5.17.1 or later, including the latest v6 pseudo-version, where this vulnerability has been patched.

Additionally, restrict write access to the local repository’s .git directories to trusted users only, minimizing the risk of malicious .idx file creation or modification.

Implement monitoring and alerting for unusual memory consumption patterns and unexpected changes in .idx files within git repositories.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0