Threats affecting pkg:golang/github.com/go-git/go-git

go-git versions prior to 5.18.0 and 6.0.0-alpha.2 contain a vulnerability where HTTP authentication credentials may be leaked when following redirects during smart-HTTP clone and fetch operations. This issue has been addressed in versions 5.18.0 and 6.0.0-alpha.2.

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

CVE-2026-33762 is a low-severity vulnerability in the go-git library prior to version 5.17.1. It involves improper validation of the path name prefix length in the index decoder for Git index format version 4. This flaw can cause an out-of-bounds slice operation leading to a runtime panic during normal index parsing. Only format version 4 is affected; earlier formats v2 and v3 are not vulnerable. The issue has been fixed in go-git version 5.17.1.