go-git Out-of-Bounds Slice Operation Vulnerability in Index Decoder Version 4

A vulnerability exists in go-git's index decoder for Git index format version 4, prior to version 5.17.1. The decoder fails to properly validate the path name prefix length before applying it to the previously decoded path name. This oversight can be exploited by a maliciously crafted index file, leading to an out-of-bounds slice operation. As a result, a runtime panic occurs during normal index parsing. This vulnerability only affects Git index format version 4; earlier formats, such as versions 2 and 3, are not vulnerable.

Impact

Exploitation of this vulnerability causes a runtime panic, which can lead to process termination and a denial-of-service condition for applications using go-git.

Remediation

Users should upgrade to go-git version 5.17.1 or the latest v6 pseudo-version to address this vulnerability.