go-git, Denial of Service (DoS), CVE-2025-21614 (Critical)

How CVE-2025-21614 Works

The vulnerability in go-git (prior to v5.13) arises due to improper handling of specially crafted Git server responses. An attacker can exploit this by sending malformed payloads (e.g., excessively large or deeply nested objects) during Git operations like clone, fetch, or pull. This triggers uncontrolled memory or CPU consumption, leading to resource exhaustion and a denial of service (DoS) condition. The issue stems from insufficient input validation in go-git’s object parsing logic, allowing an attacker to force the client into an infinite loop or excessive resource usage.

DailyCVE Form

Platform: go-git
Version: < v5.13
Vulnerability: DoS via crafted Git responses
Severity: Critical
Date: 04/16/2025

What Undercode Say:

Exploitation:

Craft malicious Git responses (e.g., oversized packfiles, malformed tree objects).
Host a fake Git repo or intercept Git traffic (MITM).

3. Trigger client-side DoS when victim clones/fetches.

Example malicious Git server (simplified)
while true; do
echo "0000000000000000000000000000000000000000 refs/heads/main" | nc -l -p 9418
done

Mitigation:

1. Upgrade to go-git v5.13+ (`go get github.com/go-git/go-git/v5@latest`).

Enforce Git protocol restrictions (e.g., limit fetch depth).

Monitor resource usage (CPU/memory spikes during Git ops).

// Safe Git client initialization (post-patch)
repo, err := git.PlainClone("/tmp/repo", false, &git.CloneOptions{
URL: "https://valid-repo.git",
Progress: os.Stdout,
Depth: 1, // Limit history fetch
})

Detection:

Log analysis for abnormal Git operations (e.g., repeated failed fetches).

Network monitoring for unexpected Git traffic patterns.

Check go-git version in Go projects
go list -m github.com/go-git/go-git/v5 | grep -Eo 'v[0-9.]+'

Additional Hardening:

Rate-limit Git operations in CI/CD pipelines.
Use SSH/GPG verification to prevent MITM attacks.

Sandbox Git processes (e.g., containers, low-privilege users).

Containerized Git operation (Docker)
docker run --memory 512m --cpu-quota 50000 alpine/git clone https://repo.git