CVE-2023-49568 is a high severity denial of service flaw, scored 7.5, in go-git before v5.11. A malicious Git server can send crafted responses that exhaust resources on the client. Upgrade to v5.11 or later, or limit your code to Git servers you trust.
What's affected
The record says go-git versions prior to v5.11 are vulnerable. The GitHub advisory GHSA-mw99-9chc-xw7r lists the range as 4.0.0 up to and including 5.11.0 in its table, while its text says prior to v5.11. The patched version is given as 5.11. Because the range and the wording differ slightly on whether 5.11.0 itself is affected, aim for the newest v5 release.
Applications that use only go-git's in-memory filesystem are not affected. The issue is in go-git's own code and does not affect the upstream git command line client. Both sources score it 7.5 High with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
How to check if you're exposed
List the go-git versions in your module graph.
go list -m all | grep go-git/go-git
Check the result against v5.11. Many tools embed go-git indirectly, so run the command in each repository you build, and also check the Go modules listed in the build metadata of binaries you ship.
go version -m ./your-binary | grep go-git
The govulncheck tool can also report whether your code calls the affected functions.
What to do now
- Run the module listing in each Go repository and note any go-git below v5.11.
- Upgrade with go get on the v5 module, then run go mod tidy and your tests.
- Rebuild and redeploy binaries that vendor or embed go-git, since an updated go.mod alone changes nothing at runtime.
- If you cannot upgrade soon, restrict clones and fetches to Git servers you trust, as the advisory suggests.
- Check indirect dependencies, such as tools that clone repositories for you.
Why it matters
The weakness is improper input validation, CWE-20. A client that trusts what a server sends can be driven to use too much memory or time. The attacker here is the Git server, which is why the advisory advises using trusted servers.
It is a client side problem, which people tend to overlook. A service that clones user supplied repository URLs, such as a CI system or a package indexer, is the scenario to worry about, because the user chooses the server. KEV status is false for this CVE.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect the git command line tool?
No. The advisory says this is a go-git implementation issue and does not affect the upstream git client.
Sources
go-git security advisory GHSA-mw99-9chc-xw7r
Last reviewed: 19 October 2026.
