VDB
GO-2026-4909
GO-2026-4909
PUBLISHED
Missing validation decoding Index v4 files leads to panic in github.com/go-git/go-git
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | chezmoi | 0, 0 |
| wolfi | nfpm | 0, 0, 0 |
| chainguard | gitlab-rails-ce-fips-18.3 | 0, 0 |
| chainguard | apko | 0, 0 |
| chainguard | cloudbeat-8.19 | 0, 0 |
| chainguard | grafana-alloy-fips | 0, 0 |
| wolfi | scorecard | 0, 0, 0 |
| chainguard | pulumi-kubernetes-operator | 0, 0 |
| wolfi | kubevela | 0, 0, 0 |
| chainguard | gptscript | 0, 0 |
| wolfi | bom | 0, 0, 0 |
| wolfi | cerbos | 0, 0, 0 |
| wolfi | zarf | 0, 0, 0 |
| chainguard | kaniko | 0, 0, 0 |
| chainguard | kyverno-1.17 | 0, 0, 0 |
| chainguard | argo-cd-fips-3.1 | 0, 0 |
| wolfi | gitsign | 0, 0, 0 |
| chainguard | steampipe | 0, 0 |
| chainguard | teleport-18 | 0, 0 |
| chainguard | crossplane-1.20 | 0, 0 |
…and 229 more
Timeline
- Apr 7, 2026 CVE Published
- Apr 8, 2026 CVE Updated