CVE-2025-21614: go-git clients vulnerable to DoS via maliciously crafted Git server replies

January 6, 2025 (updated January 31, 2025)

A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients.

This is a go-git implementation issue and does not affect the upstream git cli.

References

github.com/advisories/GHSA-r9px-m959-cxf4
github.com/go-git/go-git
github.com/go-git/go-git/security/advisories/GHSA-r9px-m959-cxf4
nvd.nist.gov/vuln/detail/CVE-2025-21614

Code Behaviors & Features

Detect and mitigate CVE-2025-21614 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →