go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Go-git |
|
| Go-git Project |
|
Configuration 1 [-]
|
No data.
References
History
Tue, 12 May 2026 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Go-git Project
Go-git Project go-git |
|
| CPEs | cpe:2.3:a:go-git_project:go-git:*:*:*:*:*:go:*:* cpe:2.3:a:go-git_project:go-git:6.0.0:alpha1:*:*:*:go:*:* |
|
| Vendors & Products |
Go-git Project
Go-git Project go-git |
Mon, 11 May 2026 19:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Fri, 08 May 2026 21:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Go-git
Go-git go-git |
|
| Vendors & Products |
Go-git
Go-git go-git |
Fri, 08 May 2026 14:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2. | |
| Title | go-git Credential leak via cross-host redirect in smart HTTP transport | |
| Weaknesses | CWE-522 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-05-11T18:50:50.673Z
Reserved: 2026-04-20T18:18:50.681Z
Link: CVE-2026-41506
Vulnrichment
Updated: 2026-05-11T18:50:36.553Z
NVD
Status : Analyzed
Published: 2026-05-08T14:16:33.983
Modified: 2026-05-12T14:33:02.040
Link: CVE-2026-41506
Redhat
No data.