Vulnerability GO-2026-5105
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
3 months ago
July 24, 2026 at 06:35 PM UTC
Go-git: Credential leak via cross-host redirect in smart HTTP transport in github.com/go-git/go-git
v5.0.0 - v5.17.2
v5.0.0 - v5.17.2
Summary
Go-git: Credential leak via cross-host redirect in smart HTTP transport in github.com/go-git/go-git
Details
Go-git: Credential leak via cross-host redirect in smart HTTP transport in github.com/go-git/go-git
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
2 months ago
Worktree operations may follow symlinks in github.com/go-git/go-git
v5.0.0 - v5.19.1 GO-2026-6213
v5.0.0 - v5.19.1 GO-2026-6213
Unknown
2 months ago
Path traversal via crafted reference names in github.com/go-git/go-git
v5.0.0 - v5.19.1 GO-2026-6214
v5.0.0 - v5.19.1 GO-2026-6214
Medium Risk
2 months ago
go-git: Malicious reference names may modify files outside the reference storage
v5.0.0 - v5.19.1 GHSA-qgq7-7hm3-q39j
v5.0.0 - v5.19.1 GHSA-qgq7-7hm3-q39j
High Risk
2 months ago
go-git: Worktree operations may follow symlinks
v5.0.0 - v5.19.1 GHSA-hc8v-wwc9-vgxm
v5.0.0 - v5.19.1 GHSA-hc8v-wwc9-vgxm
Unknown
3 months ago
Go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation in github.com/go-git/go-git
v5.0.0 - v5.18.0 GO-2026-5074
v5.0.0 - v5.18.0 GO-2026-5074
Impacted packages
Timeline
Published
3 months ago
July 24, 2026 at 06:35 PM UTC
Fixed (v5.18.0)
6 months ago
April 16, 2026 at 09:27 PM UTC
Last Modified
2 months ago
August 08, 2026 at 09:41 PM UTC