« Volver al listado

CVE-2026-33762

Estado: AnalizadaBaja (2.8)—

go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing. This issue only affects Git index format version 4. Earlier formats (go-git supports only v2 and v3) are not vulnerable to this issue. This issue has been patched in version 5.17.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Go-git Project — Go-git

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-33762",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33762",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-31T18:50:26.187250Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 2.8,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "go-git",
          "product": "go-git",
          "versions": [
            {
              "status": "affected",
              "version": "< 5.17.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-31T15:16:15.597",
  "references": [
    {
      "url": "https://github.com/go-git/go-git/releases/tag/v5.17.1",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/go-git/go-git/security/advisories/GHSA-gm2x-2g9h-ccm8",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-129"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing. This issue only affects Git index format version 4. Earlier formats (go-git supports only v2 and v3) are not vulnerable to this issue. This issue has been patched in version 5.17.1."
    },
    {
      "lang": "es",
      "value": "go-git es una biblioteca de implementación de Git extensible escrita en Go puro. Antes de la versión 5.17.1, el decodificador de índice de go-git para la versión 4 del formato no valida la longitud del prefijo del nombre de ruta antes de aplicarlo al nombre de ruta decodificado previamente. Un archivo de índice creado maliciosamente puede desencadenar una operación de segmento fuera de límites, lo que resulta en un pánico en tiempo de ejecución durante el análisis normal del índice. Este problema solo afecta a la versión 4 del formato de índice de Git. Formatos anteriores (go-git solo soporta v2 y v3) no son vulnerables a este problema. Este problema ha sido parcheado en la versión 5.17.1."
    }
  ],
  "lastModified": "2026-07-24T21:10:00.143",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:go-git_project:go-git:*:*:*:*:*:go:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B23FA8A3-7368-4B78-B80A-9BCC2F012738",
              "versionEndExcluding": "5.17.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}