7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45022

CVE-2026-45022: go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-git’s decoded representation may expose values differently from how Git itself would interpret or reject the same object. Additionally, go-git’s commit signing and verification logic operates over commit data reconstructed from go-git’s parsed representation rather than the original raw object bytes. As a result, go-git may sign or verify a commit payload that is not byte-for-byte equivalent to the object stored in the repository. This can cause a signature to appear valid for a commit whose displayed or effective metadata differs from the object that was intended to be signed. This vulnerability is fixed in 5.19.0 and 6.0.0-alpha.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45022

CVE-2026-45022:

7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/go-git/go-git/v6	go	>= 6.0.0-alpha.1, <= 6.0.0-alpha.2	6.0.0-alpha.3
github.com/go-git/go-git/v5	go	< 5.19.0	5.19.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in go-git's lenient parsing of commit and tag objects, which could lead to an interpretation of the object that is inconsistent with upstream Git. This discrepancy could be exploited to bypass signature verification. An attacker could craft a commit or tag with malformed headers that go-git would parse into a seemingly valid object, while upstream Git would either reject it or interpret it differently. When this object is signed, the signature is created for the malformed object. However, when go-git verifies the signature, it re-encodes the object from its parsed (and incorrect) representation, leading to a byte-for-byte mismatch with the original object and a failed verification. The patch addresses this by implementing a stricter, state machine-based parser for both commit and tag objects that mirrors the behavior of upstream Git. It also ensures that signature verification is performed on the raw, unmodified object bytes, rather than a re-encoded version. Finally, it adds a check to reject commits with multiple signatures, further aligning with upstream Git's behavior and reducing ambiguity.

Vulnerable functions

Commit.Decode

plumbing/object/commit.go

The original `Decode` function for `Commit` objects was vulnerable to parsing inconsistencies due to its lenient handling of malformed headers. This could cause `go-git` to interpret a commit object differently than upstream Git, leading to potential signature verification bypasses. The patch replaces this vulnerable logic with a strict state machine (`commitScanner`) that enforces the same parsing rules as upstream Git.

Tag.Decode

plumbing/object/tag.go

The `Decode` function for `Tag` objects had similar vulnerabilities to `Commit.Decode`. It could be tricked by malformed headers into parsing a tag object in a way that was inconsistent with upstream Git. The patch replaces this with a state machine (`tagScanner`) to ensure consistent and secure parsing.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.