Hi,

The following vulnerabilities were published for golang-github-go-git-go-git.

CVE-2026-71556[0]:
| go-git is an extensible git implementation library written in pure
| Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations
| (including checkout, status, and add) resolve symbolic links inside
| the working tree without confining resolution to the worktree
| boundary, so a maliciously crafted repository containing a symlink
| can cause go-git to read from or write to files outside the intended
| working directory when the repository is cloned and its worktree
| operations are used. Versions 5.19.2 and 6.0.0-alpha.5.


CVE-2026-71557[1]:
| go-git is an extensible git implementation library written in pure
| Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not
| sanitized before being used to construct on-disk paths under the
| reference storage directory, so a maliciously crafted reference name
| (for example containing directory-traversal sequences) can cause go-
| git to write files outside the intended reference storage directory.
| Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-71556
https://www.cve.org/CVERecord?id=CVE-2026-71556
[1] https://security-tracker.debian.org/tracker/CVE-2026-71557
https://www.cve.org/CVERecord?id=CVE-2026-71557

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
golang-github-go-git-go-git-v6, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1143904@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Daniel Baumann <daniel@debian.org> (supplier of updated golang-github-go-git-go-git-v6 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 08 Aug 2026 11:10:25 +0200
Source: golang-github-go-git-go-git-v6
Architecture: source
Version: 6.0.0~alpha.5-1
Distribution: sid
Urgency: medium
Maintainer: Daniel Baumann <daniel@debian.org>
Changed-By: Daniel Baumann <daniel@debian.org>
Closes: 1143904
Changes:
 golang-github-go-git-go-git-v6 (6.0.0~alpha.5-1) sid; urgency=medium
 .
   * Merging upstream version 6.0.0~alpha.5:
     - fixes Improper Link Resolution Before File Access ('Link Following')
       [CVE-2026-71556] (Closes: #1143904).
     - fixes Improper Limitation of a Pathname to a Restricted Directory
       ('Path Traversal') [CVE-2026-71557] (Closes: #1143904).
Checksums-Sha1:
 b911370e98b55baf8a61c1bd7f7acf7cd5ebcb74 2192 golang-github-go-git-go-git-v6_6.0.0~alpha.5-1.dsc
 6ba0bffd81b2678ed749c29bb5e9fdf548718702 765808 golang-github-go-git-go-git-v6_6.0.0~alpha.5.orig.tar.xz
 787842aa3ab3569efb7f3efcae04c03abc20d9a9 2808 golang-github-go-git-go-git-v6_6.0.0~alpha.5-1.debian.tar.xz
 0fa4bde9bdab02acdd4f321fabbb862fd69f1739 7518 golang-github-go-git-go-git-v6_6.0.0~alpha.5-1_amd64.buildinfo
Checksums-Sha256:
 d4acd49d6432aa6e7ddb20697a00d44404c5a8c3c2cec715292aa001b262f33e 2192 golang-github-go-git-go-git-v6_6.0.0~alpha.5-1.dsc
 6c3296992898bc3e8ea20d4304f4c7dff1ca50d7f60623b976e048b646efd534 765808 golang-github-go-git-go-git-v6_6.0.0~alpha.5.orig.tar.xz
 0e11f7ce6a091c11b5ed2eefa5a968cdc3caafbab7fb8003891479d36c03b25f 2808 golang-github-go-git-go-git-v6_6.0.0~alpha.5-1.debian.tar.xz
 d9f6ee1b3c6fce1c65a13aef69e49293bcd0411b1523cf8e6d20815938117097 7518 golang-github-go-git-go-git-v6_6.0.0~alpha.5-1_amd64.buildinfo
Files:
 dd14f2b8f6836b2f82b20a64f0ec8fc9 2192 golang optional golang-github-go-git-go-git-v6_6.0.0~alpha.5-1.dsc
 fdf62feaf637716ab33f50ac16f19aeb 765808 golang optional golang-github-go-git-go-git-v6_6.0.0~alpha.5.orig.tar.xz
 8f9c053b6fe7003cdf9881f530dcbd32 2808 golang optional golang-github-go-git-go-git-v6_6.0.0~alpha.5-1.debian.tar.xz
 38f02c843a5373658aad0a1f48cb7816 7518 golang optional golang-github-go-git-go-git-v6_6.0.0~alpha.5-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQQmmGg4gLaoSj0ERgL7tPDoCoAiLwUCanbzjgAKCRD7tPDoCoAi
LyXGAQDq9DX1py0Ap8uP4ULN7iN7vEbM4oNJGexYmu4P4OtESwEA6raHSPafIPr7
d2WKGLZCIU9o0Q0BAXaxb3iKjaQAhQM=
=IVF9
-----END PGP SIGNATURE-----