Version 5.0.0 through 5.17.0 of the go‑git library contains a flaw where a specially crafted .idx file can trigger asymmetric memory consumption that may deplete system memory and cause the process to terminate. The weakness involves improper handling of integer arithmetic (CWE‑191) and unchecked allocation size limits (CWE‑770). When the memory limit is exhausted, the application cannot serve requests and becomes unavailable.

The flaw applies to all releases of go‑git from 5.0.0 up to, but not including, 5.17.1. Any environment that uses this library and has write access to a local .git directory is potentially vulnerable, as the attacker can create or modify .idx files in the repository.

The CVSS score of 5.0 indicates a moderate impact, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would need local write access to the repository’s .git directory; no network‑side or remote exploitation path is known. Given these constraints, the risk is moderate but the probability of successful exploitation remains low.