{"cve":"CVE-2024-37904","nvd":{"published":"2024-06-18T17:15:52.337","modified":"2026-06-17T07:39:01.357","status":"Deferred","description":"Minder is an open source Software Supply Chain Security Platform. Minder's Git provider is vulnerable to a denial of service from a maliciously configured GitHub repository. The Git provider clones users repositories using the `github.com/go-git/go-git/v5` library on lines `L55-L89`. The Git provider does the following on the lines `L56-L62`. First, it sets the `CloneOptions`, specifying the url, the depth etc. It then validates the options. It then sets up an in-memory filesystem, to which it clones and Finally, it clones the repository. The `(g *Git) Clone()` method is vulnerable to a DoS attack: A Minder user can instruct Minder to clone a large repository which will exhaust memory and crash the Minder server. The root cause of this vulnerability is a combination of the following conditions: 1. Users can control the Git URL which Minder clones, 2. Minder does not enforce a size limit to the repository, 3. Minder clones the entire repository into memory. This issue has been addressed in commit `7979b43` which has been included in release version v0.0.52. Users are advised to upgrade. There are no known workarounds for this vulnerability.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","score":5.7},"cwes":["CWE-400"],"references":["https://github.com/stacklok/minder/blob/85985445c8ac3e51f03372e99c7b2f08a6d274aa/internal/providers/git/git.go#L55-L89","https://github.com/stacklok/minder/blob/85985445c8ac3e51f03372e99c7b2f08a6d274aa/internal/providers/git/git.go#L56-L62","https://github.com/stacklok/minder/commit/7979b43","https://github.com/stacklok/minder/security/advisories/GHSA-hpcg-xjq5-g666","https://github.com/stacklok/minder/blob/85985445c8ac3e51f03372e99c7b2f08a6d274aa/internal/providers/git/git.go#L55-L89"],"products":[],"source":"nvd","synced_at":"2026-10-19T21:52:00.836172422+00:00"},"epss":{"cve":"CVE-2024-37904","score":0.0046,"percentile":0.39868,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-hpcg-xjq5-g666","url":"https://osv.dev/vulnerability/GHSA-hpcg-xjq5-g666","summary":"Minder affected by denial of service from maliciously configured Git repository","modified":"2026-09-10T03:50:15.435942185Z","packages":[{"ecosystem":"Go","name":"github.com/stacklok/minder","purl":"pkg:golang/github.com/stacklok/minder","ranges":["<0.0.52"],"fixed":["0.0.52"]}]},{"id":"GO-2024-2934","url":"https://osv.dev/vulnerability/GO-2024-2934","summary":"Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder","modified":"2026-03-03T04:55:30.384243Z","packages":[{"ecosystem":"Go","name":"github.com/stacklok/minder","purl":"pkg:golang/github.com/stacklok/minder","ranges":["<0.0.52"],"fixed":["0.0.52"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}