CVE-2025-21614: go-git clients vulnerable to DoS via maliciously crafted Git server replies

January 6, 2025 (updated August 27, 2025)

A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients.

This is a go-git implementation issue and does not affect the upstream git cli.

References

github.com/advisories/GHSA-r9px-m959-cxf4
github.com/go-git/go-git
github.com/go-git/go-git/security/advisories/GHSA-r9px-m959-cxf4
nvd.nist.gov/vuln/detail/CVE-2025-21614

Code Behaviors & Features

Detect and mitigate CVE-2025-21614 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →