CVE-2025-21614: go-git clients vulnerable to DoS via maliciously crafted Git server replies
Impact A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients.
This is a go-git implementation issue and does not affect the upstream git cli.
Patches Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.
Workarounds In cases where a bump to the latest version of go-git is not possible, we recommend limiting its use to only trust-worthy Git servers.
Credit Thanks to Ionut Lalu for responsibly disclosing this vulnerability to us.
Other sources
go-git clients vulnerable to DoS via maliciously crafted Git server replies
— Microsoft
go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21614?
CVE-2025-21614 is classified as a denial of service (DoS) vulnerability.
How do I fix CVE-2025-21614?
To fix CVE-2025-21614, upgrade to version 5.13.0 or later of go-git.
Which versions of go-git are affected by CVE-2025-21614?
CVE-2025-21614 affects go-git versions prior to v5.13 and specific versions between 4.0.0 and up to 4.13.1.
What type of attack does CVE-2025-21614 enable?
CVE-2025-21614 allows an attacker to perform denial of service attacks through crafted Git server responses.
What should I do if I cannot upgrade to a fixed version for CVE-2025-21614?
If you cannot upgrade, consider implementing network security measures to filter malicious Git responses.