CVE-2026-25934: 
Packer vulnerability analysis and mitigation

CVE-2026-25934 is an improper integrity check vulnerability in go-git, a pure Go implementation of the Git version control system. The flaw causes go-git to fail to properly verify data integrity checksums for .pack and .idx files fetched from or processed by Git servers, potentially allowing consumption of corrupted data. All versions of github.com/go-git/go-git/v5 up to and including v5.16.4 are affected; the vulnerability was disclosed and patched on February 9, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, go-git Advisory).

The root cause is classified as CWE-354 (Improper Validation of Integrity Check Value): go-git did not correctly verify the embedded checksums present in Git packfiles (.pack) and their associated pack index files (.idx). Packfiles received from upstream Git servers contain a trailing checksum of their contents; .idx files are generated locally when new packfiles are processed. Neither checksum was being validated correctly, meaning corrupted or tampered file content could be silently accepted. Exploitation requires user interaction — specifically, a user or automated process must fetch from a malicious or compromised repository — and notably, the advisory clarifies that packfile checksum verification does not protect against a fully malicious server, since transport-layer trust (TLS/SSH) is the primary security boundary (GitHub Advisory, go-git Advisory).

Successful exploitation results in go-git silently consuming corrupted .pack or .idx files, leading to repository data integrity violations and unexpected errors such as "object not found." The primary impact is a low-severity integrity compromise — corrupted objects may be accepted and propagated, posing supply chain risks in automated CI/CD pipelines that use go-git to clone or fetch repositories. There is no confidentiality impact and no direct availability impact beyond application errors caused by corrupted repository state (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.005% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires user interaction (e.g., fetching from a malicious or compromised Git server), limiting its practical attack surface (GitHub Advisory, go-git Advisory).

Users should upgrade go-git to v5.16.5 or the latest v6 pseudo-version, which expands packfile integrity checks to properly validate checksums for both .pack and .idx files (go-git Release). As a temporary workaround for those unable to upgrade immediately, the advisory recommends running git fsck from the standard git CLI to check for data corruption in any affected repositories (GitHub Advisory). IBM has also issued a patch advisory for affected Data Virtualization products on IBM Software Hub (IBM Advisory). Additionally, Ubuntu has released security notice USN-8088-1 addressing this issue for affected Ubuntu packages.

The vulnerability was reported privately to the go-git project by researcher @N0zoM1z0 and was responsibly disclosed alongside the patch release on February 9, 2026. Downstream projects including Portainer (v2.33.8), pulumi-kubernetes, and IBM Data Virtualization have issued updates incorporating the fix. OpenSUSE and Ubuntu have also released security advisories addressing the issue in their respective package ecosystems (go-git Advisory, IBM Advisory).