CVE-2026-25934

CVE-2026-25934 is a data integrity vulnerability in go-git, a pure Go Git implementation library, affecting versions prior to 5.16.5. It allows go-git to consume corrupted .pack and .idx files due to improper checksum verification, potentially leading to errors like "object not found." This vulnerability has a CVSS score of 4.3 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and resulting in a low impact on integrity. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion, though it has received limited media coverage.