CVE-2025-21614

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-21614
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21614.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-21614
Aliases
Downstream
AZL (4)
CGA (487)
DEBIAN (1)
ECHO (1)
MINI (4)
openSUSE (7)
RHSA (2)
RLSA (1)
SUSE (1)
UBUNTU (1)
Related
ALSA (1)
openSUSE (6)
SUSE (1)
Published
2025-01-06T16:20:16Z
Modified
2026-10-22T10:35:14Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
go-git clients vulnerable to DoS via maliciously crafted Git server replies
Details

go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21614.json"
}
References

Affected packages

Git / github.com/go-git/go-git

Affected ranges

Type
GIT
Repo
https://github.com/go-git/go-git
Events
Introduced
bf3b1f1fb9e0a04d0f87511a7ded2562b48a19d8
Fixed
94bd4af1deb15a64e90c6287eaf9e9f09b192a1f
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "4.0.0"
                },
                {
                    "fixed": "5.13.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "cpe": "cpe:2.3:a:go-git_project:go-git:*:*:*:*:*:go:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "5.13.0"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

v4.*
v4.0.0
v4.1.0
v4.1.1
v4.10.0
v4.11.0
v4.12.0
v4.13.0
v4.13.1
v4.2.0
v4.2.1
v4.3.0
v4.3.1
v4.4.0
v4.4.1
v4.5.0
v4.6.0
v4.7.0
v4.7.1
v4.8.0
v4.8.1
v4.9.0
v4.9.1
v5.*
v5.0.0
v5.1.0
v5.10.0
v5.10.1
v5.11.0
v5.12.0
v5.2.0
v5.3.0
v5.4.0
v5.4.1
v5.4.2
v5.5.0
v5.5.1
v5.5.2
v5.6.0
v5.6.1
v5.7.0
v5.8.0
v5.8.1
v5.9.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21614.json"