The vulnerability arises when go‑git decodes Git index files of format version 4 without validating the length of the path name prefix. A maliciously crafted index file can trigger an out‑of‑bounds slice operation during normal parsing, causing a runtime panic that terminates the process. This flaw manifests as an input validation error (CWE‑1284) and an out‑of‑bounds violation (CWE‑129), resulting in a denial of service.

Any software that incorporates the go‑git library before version 5.17.1 and processes Git index files of format 4 is affected. The vulnerability does not impact earlier supported index formats (v2 and v3). The library’s index‑decoding component must be updated.

The CVSS score of 2.8 indicates low severity, and the EPSS score of less than 1 % implies exploitation is unlikely at present. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that the likely attack vector involves delivering a crafted Git index file to the application; thus the exposure is limited to environments where an attacker can influence the contents of Git repositories or index files that the application processes. The vulnerability results only in a process crash and does not grant code execution, but the potential for downtime warrants remediation.