VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/go-git/go-git/v6: vulnerability history, versions and safety

github.com/go-git/go-git/v6 is a package in the Go ecosystem. Vulert records 1 vulnerability for it across 0 release, first recorded in May 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
1 vulnerabilities recorded H1
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
1 in the last 12 months

Most recent disclosure 11 May 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/go-git/go-git/v6 vulnerabilities

Vulert verdict on github.com/go-git/go-git/v6 v6.0.0-beta.1 i

Updated on 23 Oct 2026

Good news: v6.0.0-beta.1, the version you would install today, has no known vulnerabilities. Older releases do — the table below lists all 1.

Package health score 87/100
  • Security Minor issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Active

What to do: Stay on v6.0.0-beta.1 or newer. This can change: a vulnerability disclosed tomorrow can affect v6.0.0-beta.1 too — Vulert watches the package and alerts you if that happens. Monitor it with Vulert →

  • Current release v6.0.0-beta.1 — unaffected i
  • Vulnerabilities on record 1 over 1 year · 1 in the last year i
  • Latest disclosure 11 May 2026 i
  • Highest CVSS 7.0 i
  • With no published fix 0 i
  • Stars 7,804 i
  • OpenSSF scorecard 7/10 i
  • Last release this month i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/go-git/go-git/v6, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v6.0.0-beta.1.0.20261023040806-18dfee1bbe78 23 Oct 2026 none Apache-2.0 — Details →
v6.0.0-beta.1.0.20261021151956-bed43815d13b 21 Oct 2026 none Apache-2.0 — Details →
v6.0.0-beta.1.0.20261016225838-3b930b688adc 16 Oct 2026 none Apache-2.0 — Details →
v6.0.0-beta.1.0.20261016124844-87e8ad58d23f 16 Oct 2026 none Apache-2.0 — Details →
v6.0.0-beta.1.0.20261009073342-bb92758aceaa 09 Oct 2026 none Apache-2.0 — Details →
v6.0.0-beta.1.0.20261007092635-5016e0f7f0c0 07 Oct 2026 none Apache-2.0 — Details →
v6.0.0-beta.1.0.20261006205508-d9fc61c3cab8 06 Oct 2026 none Apache-2.0 — Details →
v6.0.0-beta.1.0.20261006101203-431ad3c239ea 06 Oct 2026 none Apache-2.0 — Details →
v6.0.0-beta.1.0.20261005152300-3efcc8a355ca 05 Oct 2026 none Apache-2.0 — Details →
v6.0.0-beta.1.0.20261004145020-bc8978a79aa8 04 Oct 2026 none Apache-2.0 — Details →
v6.0.0-beta.1 04 Oct 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20261004103050-baef7b3e68b2 04 Oct 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20261002123423-fedc50f4303a 02 Oct 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20261002081705-3ab08bf9d3bb 02 Oct 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20261001215721-aa419489449c 01 Oct 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20261001204711-6bcff7e44598 01 Oct 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20261001155409-f9d46e4d91eb 01 Oct 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20261001130632-41ece0986265 01 Oct 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260930214129-321ec94b83e9 30 Sep 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260930122709-96c518c6a5f2 30 Sep 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260929121330-00c8f8e34f72 29 Sep 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260926105804-1b122021c5d6 26 Sep 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260925130615-1af9bc2a92be 25 Sep 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260924110325-a5f9c221686a 24 Sep 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260917090420-0f3a0a2c2551 17 Sep 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260916080202-3cb46ce7621c 16 Sep 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260915164738-e0993107f4a1 15 Sep 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260913084256-29c4ef62fd94 13 Sep 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260911112727-da885a3057a2 11 Sep 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260910234920-337293fca38f 10 Sep 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260910092924-d15c624290f1 10 Sep 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260909113043-fecc37886507 09 Sep 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260908152337-c3e96df0c369 08 Sep 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260907191556-57ed51864460 07 Sep 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260903224701-e9e5820fe0d2 03 Sep 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260826050912-52f84ef3eb00 26 Aug 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260825110412-2ef9e4b0047b 25 Aug 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260824140246-e37764fd3023 24 Aug 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260824080355-a422a2046a67 24 Aug 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260821142625-374c354884f1 21 Aug 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260820211627-0551cb44e98d 20 Aug 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260820210417-e84b7de23826 20 Aug 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260820210142-605cbd7629a6 20 Aug 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260820153209-e68eaf0623df 20 Aug 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260817061408-b15e610fe5cb 17 Aug 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260813120522-ec5f6dc473fb 13 Aug 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260813061505-01ffb29d9203 13 Aug 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260812155443-34770e01d7c2 12 Aug 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260812095450-22b9459b2be0 12 Aug 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260812092507-e63910ab7739 12 Aug 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260812061206-97f13e721bf9 12 Aug 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260811102426-7cf4f60d92ac 11 Aug 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260810111237-422eb768c9c3 10 Aug 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260803141802-d6cbbfaaefb9 03 Aug 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5.0.20260730134444-cf4d91c78c32 30 Jul 2026 none Apache-2.0 — Details →
v6.0.0-20260729090120-fc18716c90bc 29 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260729090120-fc18716c90bc 29 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.5 29 Jul 2026 none Apache-2.0 — Details →
v6.0.0-20260727084107-9b81545704e8 27 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260727084107-9b81545704e8 27 Jul 2026 none Apache-2.0 — Details →
v6.0.0-20260726080237-8bff61114bb7 26 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260726080237-8bff61114bb7 26 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260725113005-ffa616afd85b 25 Jul 2026 none Apache-2.0 — Details →
v6.0.0-20260724214901-661d1c7f101d 24 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260724214901-661d1c7f101d 24 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260724104102-b092a7b2f62a 24 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260724090626-0234842499be 24 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260724085316-02e4490b714e 24 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260723212339-98d83ca44d4a 23 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260723200231-97a5f5552f6e 23 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260723160806-75f92acd2a83 23 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260723090604-60464dfcf1b9 23 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260720134024-6a082fae5965 20 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260716142645-5f90b841aef2 16 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260716101637-a0affcff0cc6 16 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260715223331-3a41829f71f7 15 Jul 2026 none Apache-2.0 — Details →
v6.0.0-20260715120110-da9f7d8a0e98 15 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260715120110-da9f7d8a0e98 15 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.3.0.20260715113742-f9d1128c6950 15 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260715113742-f9d1128c6950 15 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260713100844-d5e9b9c7895b 13 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260709083728-bcae8da57228 09 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260707125336-d60654d4f998 07 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260706163144-533c6877795c 06 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260703084920-0fddf2c2370e 03 Jul 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260630113050-c5436660cc2e 30 Jun 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260626131229-c31b1f53b87e 26 Jun 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260626111302-34fa78dd321e 26 Jun 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260625151526-a7ac18b9cf80 25 Jun 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260624162408-6df7a38c442f 24 Jun 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260623164225-1329b3f1a147 23 Jun 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260623142818-a3fc94edb36b 23 Jun 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260623102204-021db38abcc4 23 Jun 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260623053331-45785cbb8e9d 23 Jun 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260622135933-95b9bc5b6464 22 Jun 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260622133640-e519c7a5d503 22 Jun 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260616150847-bc4de5eb6836 16 Jun 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260609112911-f4b85e43694f 09 Jun 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260608211510-8daf58784007 08 Jun 2026 none Apache-2.0 — Details →
v6.0.0-alpha.4.0.20260602222058-053c039455d2 02 Jun 2026 none Apache-2.0 — Details →
v6.0.0-20260529215654-6923824fe448 29 May 2026 none — — Details →
v6.0.0-alpha.4.0.20260529215654-6923824fe448 29 May 2026 none — — Details →
v6.0.0-20260528151159-47a7ba42ed24 28 May 2026 none — — Details →
v6.0.0-alpha.4.0.20260528145909-76ca4f1fb4f6 28 May 2026 none — — Details →
v6.0.0-alpha.4.0.20260526111226-b86162364e72 26 May 2026 none — — Details →
v6.0.0-alpha.4.0.20260522102124-fde2d6d3d804 22 May 2026 none — — Details →
v6.0.0-alpha.4.0.20260521161150-3af8745c291b 21 May 2026 none — — Details →
v6.0.0-alpha.4.0.20260521151600-590487407c38 21 May 2026 none — — Details →
v6.0.0-alpha.4.0.20260520124234-0860a7d8a164 20 May 2026 none — — Details →
v6.0.0-20260518135925-d9a698310823 18 May 2026 none — — Details →
v6.0.0-alpha.4 18 May 2026 none — — Details →
v6.0.0-alpha.3.0.20260514141502-41ab5f4851ec 14 May 2026 none — — Details →
v6.0.0-alpha.3.0.20260513123100-c6f1dccecf9c 13 May 2026 none — — Details →
v6.0.0-alpha.3.0.20260513092620-5f8076d23592 13 May 2026 none — — Details →
v6.0.0-alpha.3.0.20260512141313-533ba09d9588 12 May 2026 none — — Details →
v6.0.0-alpha.3.0.20260511200141-488798e28afd 11 May 2026 none — — Details →
v6.0.0-alpha.3.0.20260511135821-b6e54140ca7e 11 May 2026 none — — Details →
v6.0.0-alpha.3.0.20260510194355-814ee83c98dd 10 May 2026 none — — Details →
v6.0.0-alpha.3.0.20260507221227-c9084f20dee2 07 May 2026 none — — Details →
v6.0.0-20260507210407-9083a1adf313 07 May 2026 none — — Details →

The newest 120 of 346 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2026 1

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 1 of the 1 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/go-git/go-git/v6

The 1 most severe of 1 vulnerabilities recorded for this package

Search all 1 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2026-45022: go-git Improper Parsing of Malformed Git Objects Leading to Signature Validation Issues 7.0 high 6.0.0-alpha.3 11 May 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/go-git/go-git/v6

Is github.com/go-git/go-git/v6 safe to use?

Vulert records 1 vulnerabilities for github.com/go-git/go-git/v6 in Go: 0 critical, 1 high, 0 medium and 0 low. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/go-git/go-git/v6's Vulert package health score?

Vulert scores github.com/go-git/go-git/v6 87/100, which reads as healthy. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/go-git/go-git/v6 affected?

No. v6.0.0-beta.1, the version you would install today, has no vulnerabilities on record against it. Earlier releases do — the version table above lists each release with what affects it.

Which version of github.com/go-git/go-git/v6 should I use?

v6.0.0-beta.1 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/go-git/go-git/v6 have?

1 vulnerability is recorded for github.com/go-git/go-git/v6 in the Go ecosystem: 0 critical, 1 high, 0 medium and 0 low. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/go-git/go-git/v6 vulnerabilities disclosed?

1 vulnerability was recorded for github.com/go-git/go-git/v6 in the last 12 months, and the oldest entry in this database dates to 11 May 2026. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/go-git/go-git/v6 are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/go-git/go-git/v6 for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/go-git/go-git/v6 version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.