go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1411-1 advisory.

    This update for terraform-provider-local, terraform-provider-random, terraform-provider-tls fixes the     following issue:

    - CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack     and .idx files that can lead to the consumption of corrupted files (bsc#1258097).
    - CVE-2026-33186: fix authorization bypass in grpc-go due to improper validation of the HTTP/2 :path     pseudo-header (bsc#1260218)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8088-1 advisory.

    Ionut Lalu discovered that go-git incorrectly handled certain specially crafted Git server responses. An     attacker could possibly use this issue to cause a denial of service. (CVE-2023-49568, CVE-2025-21614)

    Ionut Lalu discovered that go-git incorrectly handled file system paths when using the ChrootOS     implementation. A remote attacker could possibly use this issue to perform a path traversal and create or     modify arbitrary files, leading to remote code execution. (CVE-2023-49569)

    It was discovered that go-git did not properly sanitize arguments when invoking git-upload-pack using the     file transport protocol. An attacker could possibly use this issue to inject arbitrary flag values when     interacting with local Git repositories. (CVE-2025-21613)

    It was discovered that go-git did not properly verify integrity checks for pack and index files. An     attacker could possibly use this issue to cause go-git to process corrupted repository data, resulting in     unexpected errors or an incorrect repository state. (CVE-2026-25934)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a     vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not     properly verified. This resulted in go-git potentially consuming corrupted files, which would likely     result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream     Git servers. Those files contain a checksum of their contents, so that clients can perform integrity     checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when     new .pack files are received and processed. The integrity checks for both files were not being verified     correctly. This vulnerability is fixed in 5.16.5. (CVE-2026-25934)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
306872	SUSE SLES15 / openSUSE 15 Security Update : terraform-provider-local, terraform-provider-random, terraform-provider-tls (SUSE-SU-2026:1411-1)	Nessus	SuSE Local Security Checks	medium
302212	Ubuntu 22.04 LTS / 24.04 LTS : go-git vulnerabilities (USN-8088-1)	Nessus	Ubuntu Local Security Checks	critical
298456	Linux Distros Unpatched Vulnerability : CVE-2026-25934	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-25934

medium

Tenable Plugins

medium

critical

medium