Hi,

The following vulnerabilities were published for golang-github-go-git-go-git.

CVE-2026-71556[0]:
| go-git is an extensible git implementation library written in pure
| Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations
| (including checkout, status, and add) resolve symbolic links inside
| the working tree without confining resolution to the worktree
| boundary, so a maliciously crafted repository containing a symlink
| can cause go-git to read from or write to files outside the intended
| working directory when the repository is cloned and its worktree
| operations are used. Versions 5.19.2 and 6.0.0-alpha.5.


CVE-2026-71557[1]:
| go-git is an extensible git implementation library written in pure
| Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not
| sanitized before being used to construct on-disk paths under the
| reference storage directory, so a maliciously crafted reference name
| (for example containing directory-traversal sequences) can cause go-
| git to write files outside the intended reference storage directory.
| Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-71556
https://www.cve.org/CVERecord?id=CVE-2026-71556
[1] https://security-tracker.debian.org/tracker/CVE-2026-71557
https://www.cve.org/CVERecord?id=CVE-2026-71557

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
golang-github-go-git-go-git, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1143903@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Reinhard Tartler <siretart@tauware.de> (supplier of updated golang-github-go-git-go-git package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 21 Sep 2026 21:15:47 -0400
Binary: go-git go-git-dbgsym golang-github-go-git-go-git-dev golang-github-go-git-go-git-v5-dev
Source: golang-github-go-git-go-git
Architecture: all amd64 source
Version: 5.19.2-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed-By: Reinhard Tartler <siretart@tauware.de>
Closes: 1138090 1142868 1143903 1146194
Description:
 go-git     - highly extensible Git implementation in pure Go (command line)
 golang-github-go-git-go-git-dev - highly extensible Git implementation in pure Go (transitional pac
 golang-github-go-git-go-git-v5-dev - highly extensible Git implementation in pure Go (v5)
Changes:
 golang-github-go-git-go-git (5.19.2-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream version 5.19.2. (Closes: #1143903)
     - Fix path traversal in reference names (CVE-2026-71557).
     - Restrict symlink resolution to worktree boundary (CVE-2026-71556).
   * Rename binary package to golang-github-go-git-go-git-v5-dev and provide
     transitional golang-github-go-git-go-git-dev package.
   * debian/patches:
     - Add 0004 and 0005 to fix FTBFS with Go 1.27 (Closes: #1146194).
     - Add 0006 to serialize packfile fixture extraction (Closes: #1138090).
     - Add 0007 to respect context cancellation in utils/ioutil (Closes: #1142868).
     - Renumber existing patches with numeric prefixes.
Checksums-Sha1:
 3ee28fa7613fd1286717a8a1ff73cd63f5e56cc5 3544 golang-github-go-git-go-git_5.19.2-1.dsc
 5b8e841351bff459f13749aec036ab0ebd824a2c 466044 golang-github-go-git-go-git_5.19.2.orig.tar.xz
 802b0299d9f8f1589c7820dcf65d12e341cc60e7 11368 golang-github-go-git-go-git_5.19.2-1.debian.tar.xz
 45f64d8d6838cde21364286d9f07af481529ac27 3238104 go-git-dbgsym_5.19.2-1_amd64.deb
 a6981ddcff0fd7f460f284674bfef6c64b2ed70a 2945628 go-git_5.19.2-1_amd64.deb
 82faac2120dd0a662a2ce3c42edb4354e11e7cd9 3832 golang-github-go-git-go-git-dev_5.19.2-1_all.deb
 bd8ee2df03072808fda951621c05c21cd3bfc439 430104 golang-github-go-git-go-git-v5-dev_5.19.2-1_all.deb
 de86992de64ce25ebaf9cce4754b713f833c7b57 10250 golang-github-go-git-go-git_5.19.2-1_amd64.buildinfo
Checksums-Sha256:
 1b11762a3de98f3ee9f351eecda68cd5948ea4dc60f38d72e2f336a8b51d830f 3544 golang-github-go-git-go-git_5.19.2-1.dsc
 6243e3ceee3ae7db35679a30bfdbc3158fb72e91dc870db47daae587f7b5d722 466044 golang-github-go-git-go-git_5.19.2.orig.tar.xz
 54d19bc341df4efc0850b35e5b54eafe866ca9ad61db64ab8c4f075152d670e2 11368 golang-github-go-git-go-git_5.19.2-1.debian.tar.xz
 a86e62ea84448c1c33a5615bcd18c9b354af5218e9bfb33c6a0a41a28f88add5 3238104 go-git-dbgsym_5.19.2-1_amd64.deb
 284fe26b1b4695e035b29b4d2c5dbb5054fef6d7bfa5ca06dcfbb89cb1bf8a00 2945628 go-git_5.19.2-1_amd64.deb
 b4865b12bc4758b6bdd00df1fe64b2e98807a09ea34eabae3c2b8fd0d55cab2c 3832 golang-github-go-git-go-git-dev_5.19.2-1_all.deb
 b035cb2de27532a6cf0ffbf0023011c9ee0dc386b155c38a3d970f28f7828849 430104 golang-github-go-git-go-git-v5-dev_5.19.2-1_all.deb
 fd03147e3c52033c99e044305bc7b83b30fc3d7361a8ece5ceec2c031383b3d1 10250 golang-github-go-git-go-git_5.19.2-1_amd64.buildinfo
Files:
 a6d7dea61eb89ce7c6af48d3cc95ece9 3544 golang optional golang-github-go-git-go-git_5.19.2-1.dsc
 f7e7414d4b2ae2ac43f227d8655b5795 466044 golang optional golang-github-go-git-go-git_5.19.2.orig.tar.xz
 487f446e43181ecd7b4983cf9038e235 11368 golang optional golang-github-go-git-go-git_5.19.2-1.debian.tar.xz
 3d8e297381378af9e6361d70d0884e17 3238104 debug optional go-git-dbgsym_5.19.2-1_amd64.deb
 33ddda04add6dd078e7023244a653b48 2945628 golang optional go-git_5.19.2-1_amd64.deb
 519acda54081d6824876bffc15e866c5 3832 oldlibs optional golang-github-go-git-go-git-dev_5.19.2-1_all.deb
 32eff7338c234d607ba519fde2fd5612 430104 golang optional golang-github-go-git-go-git-v5-dev_5.19.2-1_all.deb
 48c4143e6e404049886c890c4e512d7d 10250 golang optional golang-github-go-git-go-git_5.19.2-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJIBAEBCgAyFiEEMN59F2OrlFLH4IJQSadpd5QoJssFAmqx19sUHHNpcmV0YXJ0
QHRhdXdhcmUuZGUACgkQSadpd5QoJsv/zxAAt/X7I0typ7OpUtisbQIgqmEiwWp5
8zboFM5QGmJ6CmgBnvY2+LzdE89dYX35ror1/Kq1NqluODhVMyYeKUlIBU3hk6h7
yejBt+URdrB/yO9Ut3sq2UuEBwhoT5vpekkTl/OYbST1vSsquftPdOo9w/nDhQ0l
VzNfcByeCjwg+SUhhRYADcbgg1fkP/elZUpU4Yhv7gjVKgWf7OvpND5OZmuH6j9b
T44va7eB3jljs0m2lUOnyScaTNQVxxPsi+J8y8xWHK3QbjB9fkQEoHNNAWVJIkFq
/kFs+aspYqbq+czIIlIUBsl07XjJgp5JSurKcjgQxOpn2rf5w5Sgm4Vfw9Ad0t1h
E2DOj7IlBQnsYICf1X88znIL5vYuJggfo5CdAybWb6oMQb2S3sbO62mTNEdaU9VX
obeUOwKhT/3IuShrcUdOsRHL1NieqX1nf6HXN9L0nTYRuNHkIn7Nt9EzDVUDS8Rx
qLFyqJL+8w2IJCKEQCnlOWBQbQKeAyAWg08VUfhD8Pnfehj2Dfu2ZO1jRR4pcyUN
d/SS3O2479HvACPTRlQsbvb0iHwePrrLrJxQWyqh7g9oTf6OvaiXn2RONn4qecDq
cqrwdlN45L3alkJF4JBSR+FZJu1tWv82XJpmGPlgI5/u3ZXWSzhC0+uEtoAVHQBz
s/y8DMahPvlaPOU=
=/A60
-----END PGP SIGNATURE-----