go‑git parses commit or tag objects that contain ambiguous or malformed headers differently than upstream Git, which can produce a decoded representation that does not match the actual bytes stored in a repository. Because the library’s signing and verification routines operate on that decoded data, a commit may be signed or verified successfully even though its true content differs from what a standard Git client would accept or reject. This flaw can make a forged or altered commit appear to have a valid signature, potentially undermining the integrity guarantees expected of signed artifacts.

Any application that links against go‑git older than version 5.19.0 or 6.0.0‑alpha.3 is susceptible. The vulnerability is tied to the library itself and affects all projects that rely on it to parse, sign, or verify Git objects, including custom Git‑based tooling, CI/CD systems, and any services that fetch or manipulate repositories using this library.

The CVSS base score of 7 indicates high severity. The EPSS score is not available, so the probability of exploitation is unknown, but the flaw is technical and not trivial to trigger. There is no public KEV listing, indicating that no widespread exploit material is currently known. Attackers would need to supply or inject a malicious commit or tag object that contains malformed headers; in a scenario where the application automatically processes such objects—such as during repository fetches or automated pull requests—the signature verification could be bypassed, allowing an attacker to introduce tampered code into downstream builds or deployments without detection.