ZeroDay Findings
Sign inSign up

Findings

CVE-2026-41506

go-git is an extensible git implementation library written in pure Go.

Published May 8, 2026 · updated Jun 17, 2026 · go-git project go-git

go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. May 8, 2026 · NIST NVD

    Detected

    go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.

  2. Jun 17, 2026 · NIST NVD

    Updated

    go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.

Affected

  • cpe go-git project/go-gitversion unspecified
  • cpe go-git project/go-git6.0.0

Sources

  • CVE.orgVulnerability recordCVE-2026-41506

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-41506

    go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0

    nvd.nist.gov

References