CVE-2026-53587
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
libgit2 before versions 1.8.6 and 1.9.5 performs a fixed-size strncmp in set_data without verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can cause format_str to advance beyond the pkt-line and the following memchr length calculation to underflow, leading to a heap out-of-bounds read that can crash a client during the first refs-advertisement packet.
Risk Assessment
A client connecting to a malicious Git server may crash, potentially disrupting applications using libgit2.
Recommendation
Upgrade libgit2 to version 1.8.6 or 1.9.5, which include the fix.
Other vulnerabilities in libgit2
See all- CVE-2016-10129High
The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line.
- CVE-2016-10128Critical
Buffer overflow in the git_pkt_parse_line function in Git Smart Protocol support in libgit2 before version 0.24.6 and 0.25.x before version 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.
- CVE-2026-53586Medium
libgit2 before versions 1.8.6 and 1.9.5 has a vulnerability in the built-in HTTP transport that allows following an offsite redirect and sending credentials to an untrusted host. An attacker controlling a trusted Git host or an open redirect can disclose HTTP Basic credentials, personal access tokens, or equivalent credentials.
- CVE-2026-53585Medium
libgit2 before versions 1.8.6 and 1.9.5 has a vulnerability in git_delta_apply that trusts the attacker-controlled res_sz value, potentially leading to excessive memory allocations and memory exhaustion. Malicious pack data can be supplied via git_clone, git_fetch, git_remote_fetch, git_indexer_append, or a local repository.
- CVE-2026-53584Medium
libgit2 before versions 1.8.6 and 1.9.5 does not reject traversal components in a submodule path loaded from .gitmodules. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree.
- CVE-2026-53583Medium
libgit2 before versions 1.8.6 and 1.9.5 has a vulnerability in verify_server_cert that uses an inverted !!memcmp result in the GEN_IPADD branch when comparing an IP-literal host with a certificate IP SubjectAltName. This causes rejection of matching IP addresses and acceptance of mismatched ones, allowing an attacker with a CA-trusted certificate to intercept connections to IP-literal HTTPS URLs.
- CVE-2026-5917High
libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.
Original NVD description (English source)
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in versions 1.8.6 and 1.9.5.