CVE-2026-33762: 
Packer vulnerability analysis and mitigation

CVE-2026-33762 is a denial-of-service vulnerability in go-git, a pure Go implementation of the Git version control system. The index decoder for Git index format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name, allowing a maliciously crafted .git/index file to trigger an out-of-bounds slice operation and runtime panic. Affected versions are all releases of github.com/go-git/go-git/v5 up to and including v5.17.0; only Git index format version 4 is affected (v2 and v3 are not vulnerable). The vulnerability was reported privately by researcher @kq5y, published on March 29–30, 2026, and assigned a CVSS v3.1 base score of 2.8 (Low) (GitHub Advisory, Github Advisory DB).

The root cause is improper validation of an array index (CWE-129): the index decoder for Git index format version 4 reads a path name prefix length from the file without bounds-checking it against the length of the previously decoded path name before performing a slice operation. An attacker who can place a crafted .git/index file on disk — requiring local write access to the .git directory — can trigger an out-of-bounds slice that causes a Go runtime panic during normal index parsing. The fix was implemented in PR #1935 (plumbing: format/index, Improve v4 entry name validation) included in the v5.17.1 release (GitHub Advisory, v5.17.1 Release).

Successful exploitation causes a Go runtime panic in any application using go-git to parse a Git index, which — if the application does not recover from panics — results in process termination and a denial-of-service (DoS) condition. There is no impact on confidentiality or data integrity; the sole consequence is availability loss scoped to the affected process. The vulnerability does not enable remote code execution, privilege escalation, or lateral movement (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported. The EPSS score is approximately 0.006% (0th percentile), indicating a very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local write access to the .git directory and user interaction (a user or process must trigger index parsing), significantly limiting the attack surface (Github Advisory DB).

1. Gain write access: Obtain local write access to the .git directory of a repository processed by an application using go-git v5.17.0 or earlier.
2. Craft malicious index file: Create a Git index file in format version 4 with a path name prefix length field set to a value exceeding the length of the previously decoded path name entry, producing an invalid slice boundary.
3. Place the file: Replace or inject the crafted file as .git/index in the target repository on disk.
4. Trigger index parsing: Cause the target application to read the repository index — for example, by initiating a git status, checkout, or any operation that causes go-git to decode the index file.
5. Achieve DoS: The out-of-bounds slice operation triggers a Go runtime panic; if the application does not recover, the process terminates, resulting in a denial-of-service condition (GitHub Advisory).

• File System: Unexpected modification timestamp on .git/index inconsistent with normal git operations; .git/index file with a format version 4 header (DIRC magic bytes followed by version bytes \x00\x00\x00\x04) in repositories where version 4 is not expected.
• Logs / Process: Sudden application crash or Go runtime panic stack trace referencing go-git index decoding functions (e.g., plumbing/format/index) in application logs; unexpected process termination of services that use go-git for repository operations.

Users should upgrade github.com/go-git/go-git/v5 to v5.17.1 or use the latest v6 pseudo-version, both of which include improved validation of path name prefix lengths in the index v4 decoder. No configuration-based workaround is available; upgrading is the only remediation. Downstream projects and tools that embed go-git (e.g., Portainer, external-secrets, Forgejo Runner, JFrog CLI) should also update their dependencies to pull in the patched version (GitHub Advisory, v5.17.1 Release).

The vulnerability was responsibly disclosed by researcher @kq5y directly to the go-git maintainers and patched promptly. Several downstream projects — including Portainer, external-secrets, JFrog CLI, and Forgejo Runner — have released updates incorporating the fix, indicating broad ecosystem awareness. No significant public controversy or media coverage beyond standard advisory distribution has been observed.