CVE-2025-21614: Go-Git Project Go-Git

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.

Affected products

• Go-Git Project Go-Git: before 5.13.0 (fixed in 5.13.0)

Published 2025-01-06. Last modified 2026-06-17.