CVE-2025-21614

A denial of service (DoS) vulnerability was found in go-git. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server, which triggers resource exhaustion in go-git clients.

IMPORTANT: Red Hat products that ship or use the vulnerable go-git client behavior are affected by a denial-of-service vulnerability in go-git clients. An attacker can provide specially crafted replies from a Git server to a go-git client, causing resource exhaustion and potentially making the client unavailable; the current CVSS is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The current affects include affected component records across Red Hat Enterprise Linux, OpenShift Container Platform, Red Hat OpenShift GitOps, OpenShift Virtualization, Red Hat OpenShift Serverless, Red Hat Advanced Cluster Security, Red Hat OpenShift AI, Red Hat OpenStack Platform, Red Hat Ceph Storage, and other Red Hat products. Seven OpenShift Container Platform openshift-clients records are explicitly marked not affected because the vulnerability requires the vulnerable go-git client behavior. Affected records are delegated: records delegated as AFFECTED indicate that a fix is being pursued, WONTFIX records do not have a fix planned, and the Red Hat OpenStack Platform records marked DEFER have no deferral rationale in the current flaw; their residual risk is the same potential denial of service if a malicious Git server response reaches the component.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.