CVE-2026-25934

go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.

• CWE-354

• https://github.com/go-git/go-git/releases/tag/v5.16.5Product, Release Notes
• https://github.com/go-git/go-git/security/advisories/GHSA-37cx-329c-33x3Patch, Vendor Advisory

Published

Feb 9, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25929OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-2593The Greenshift – animation and page builder blocks plugin fo…6.4
• CVE-2026-25930OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-25931vscode-spell-checker is a basic spell checker that works wel…7.8
• CVE-2026-25932GLPI is a Free Asset and IT Management Software package. Fro…4.8
• CVE-2026-25933Arduino App Lab is a cross-platform IDE for developing Ardui…6.8
• CVE-2026-25935Vikunja is a todo-app to organize your life. Prior to 1.1.0,…5.4
• CVE-2026-25936GLPI is a free Asset and IT management software package. Sta…8.8
• CVE-2026-25937GLPI is a free Asset and IT management software package. Sta…6.5
• CVE-2026-25938FUXA is a web-based Process Visualization (SCADA/HMI/Dashboa…9.8
• CVE-2026-25939FUXA is a web-based Process Visualization (SCADA/HMI/Dashboa…9.1
• CVE-2026-2594The Smart Custom Fields plugin for WordPress is vulnerable t…6.4