CVE-2026-34165: 
Packer vulnerability analysis and mitigation

CVE-2026-34165 is a Denial of Service (DoS) vulnerability in the go-git library (a pure Go implementation of Git) caused by asymmetric memory consumption when parsing a maliciously crafted .idx file. It affects go-git versions 5.0.0 through 5.17.0 (inclusive) and was privately reported by researcher @kq5y to the go-git maintainers. The advisory was published on March 29–30, 2026, with NVD publication on March 31, 2026. It carries a CVSS v3.1 base score of 5.0 (Medium) (GitHub Advisory, go-git Advisory).

The root cause is a combination of CWE-191 (Integer Underflow/Wrap or Wraparound) and CWE-770 (Allocation of Resources Without Limits or Throttling) in go-git's .idx file parsing logic — specifically in the plumbing/format/idxfile package where version and fanout checks were insufficient. An attacker with write access to a repository's .git directory can craft or alter a .idx pack index file to trigger an integer underflow, causing the library to allocate an unbounded amount of memory when the file is subsequently processed. The fix in v5.17.1 introduced improved v4 entry name validation and corrected version and fanout checks (GitHub Advisory, go-git Release).

Successful exploitation results in memory exhaustion on the host running the vulnerable go-git code, leading to a Denial of Service condition that can crash or hang git-related operations. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. Applications and CI/CD pipelines that use go-git to process untrusted or shared repositories are most at risk, as an attacker with local write access to the .git directory could disrupt repository operations for all users of that system (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. Exploitation requires low-privilege local access and user interaction (i.e., another user or process must trigger parsing of the malicious .idx file), significantly limiting the attack surface. The EPSS score is approximately 0.013% (0th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Gain local write access: Obtain low-privileged write access to a target system's local Git repository .git directory — for example, through a shared development environment or a compromised local account.
2. Craft a malicious .idx file: Create or modify a pack index (.idx) file within .git/objects/pack/ with specially crafted version or fanout values designed to trigger an integer underflow in go-git's parsing logic.
3. Trigger parsing: Wait for or induce a victim process (e.g., a CI/CD pipeline, automated script, or another user) running a vulnerable version of go-git (v5.0.0–v5.17.0) to perform a git operation that reads the malicious .idx file (e.g., git fetch, git clone, or pack file inspection).
4. Achieve DoS: The integer underflow causes go-git to allocate memory without bounds, exhausting available system memory and resulting in a crash or hang of the affected process (GitHub Advisory, go-git Advisory).

• File System: Unexpected or recently modified .idx files in .git/objects/pack/ with anomalous file sizes or malformed headers; .idx files with unusual fanout table values.
• Process: Go-git-based processes (CI/CD agents, git tooling) consuming abnormally high memory (approaching system limits) before crashing or being OOM-killed.
• Logs: Out-of-memory (OOM) kernel log entries (dmesg or /var/log/syslog) associated with go-git processes; application-level panics or error messages referencing plumbing/format/idxfile in go-git stack traces.

Users should upgrade go-git to v5.17.1 or the latest v6 pseudo-version, which includes fixes for version and fanout validation in the .idx file parser (go-git Release, GitHub Advisory). No configuration-based workaround is available; upgrading is the only remediation. As a defense-in-depth measure, restrict write access to .git directories on shared systems to minimize the risk of a malicious .idx file being introduced.

The vulnerability was responsibly disclosed by researcher @kq5y directly to the go-git maintainers and patched promptly. Several downstream projects that depend on go-git — including Portainer, CircleCI Server, external-secrets, pulumi-kubernetes, and Forgejo Runner — have released updates incorporating the fix, indicating broad ecosystem awareness. Tenable/Nessus and Qualys have both added detection plugins for this CVE, reflecting standard scanner coverage for a moderate-severity library vulnerability (go-git Release).