A flaw in the go‑git library’s decoder for git index format version 4 allows a maliciously crafted index file to cause an out‑of‑bounds slice operation, resulting in a runtime panic during normal parsing. This crash terminates the application using go‑git, effectively denying service to legitimate users. The weakness is an integer bounds check error as catalogued by CWE‑129.

The vulnerability impacts the go‑git library prior to version 5.17.1. Only index files of format v4 are affected; earlier supported formats v2 and v3 are not vulnerable. Any application that imports or parses such a file will be exposed if it uses an affected library version.

The CVSS score of 2.8 indicates a low severity. No EPSS score is publicly available and the issue is not listed in the CISA KEV catalog. The attack vector is inferred to involve supplying a crafted index file to an application that processes git repositories with go‑git, which could occur locally or from a remote source if the application downloads or receives untrusted repositories. Given the lack of publicly known exploits and the low CVSS, overall risk remains low, though any running instance parsing untrusted data could be disrupted.