CVE-2025-21614
Description
A denial of service (DoS) vulnerability was found in go-git. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server, which triggers resource exhaustion in go-git clients.
Statement
IMPORTANT: Red Hat products that ship or use the vulnerable go-git client behavior are affected by a denial-of-service vulnerability in go-git clients. An attacker can provide specially crafted replies from a Git server to a go-git client, causing resource exhaustion and potentially making the client unavailable; the current CVSS is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The current affects include affected component records across Red Hat Enterprise Linux, OpenShift Container Platform, Red Hat OpenShift GitOps, OpenShift Virtualization, Red Hat OpenShift Serverless, Red Hat Advanced Cluster Security, Red Hat OpenShift AI, Red Hat OpenStack Platform, Red Hat Ceph Storage, and other Red Hat products. Seven OpenShift Container Platform openshift-clients records are explicitly marked not affected because the vulnerability requires the vulnerable go-git client behavior. Affected records are delegated: records delegated as AFFECTED indicate that a fix is being pursued, WONTFIX records do not have a fix planned, and the Red Hat OpenStack Platform records marked DEFER have no deferral rationale in the current flaw; their residual risk is the same potential denial of service if a malicious Git server response reaches the component.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
