libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in versions 1.8.6 and 1.9.5.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rust-analyzerUpgrade rust-lldbUpgrade rust-toolsetUpgrade rust-std-static-wasm32-wasip1Upgrade rust-srcUpgrade rust-gdbUpgrade rust-std-static-wasm32-unknown-unknownUpgrade rust-std-staticUpgrade cargoUpgrade rustUpgrade rust-docUpgrade rustfmtUpgrade rust-debugger-commonUpgrade clippy | Oct 11, 2026 | Sep 14, 2026 |
| Alpine Linux | — | Upgrade libgit2 | Aug 21, 2026 | Aug 20, 2026 |
| Amazon Linux Ami 2 | — | Upgrade clippyUpgrade cargoUpgrade rust-toolset-srpm-macrosUpgrade rust-docUpgrade rust-analyzerUpgrade rust-toolsetUpgrade rust-gdbUpgrade rustUpgrade rust-debugger-commonUpgrade rustfmtUpgrade rust-std-staticUpgrade rust-src | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade rustfmtUpgrade rustfmt-debuginfoUpgrade rust-debugger-commonUpgrade rustUpgrade cargo-cUpgrade libgit2-debuginfoUpgrade network-flow-monitor-agent-debugsourceUpgrade libgit2-debugsourceUpgrade clippyUpgrade rust-debuginfoUpgrade rust-analyzer-debuginfoUpgrade rust-srcUpgrade rust-toolset-srpm-macrosUpgrade libgit2Upgrade cargoUpgrade network-flow-monitor-agent-debuginfoUpgrade rust-docUpgrade rust-std-staticUpgrade cargo-c-debuginfoUpgrade libgit2-develUpgrade rust-debugsourceUpgrade rust-std-static-wasm32-wasip1Upgrade rust-toolsetUpgrade rust-analyzerUpgrade rust-std-static-wasm32-unknown-unknownUpgrade rust-gdbUpgrade rust-cargo-c-debugsourceUpgrade network-flow-monitor-agentUpgrade cargo-debuginfoUpgrade clippy-debuginfoUpgrade rust-lldb | Aug 21, 2026 | Aug 20, 2026 |
| Debian | — | Upgrade libgit2 | Aug 23, 2026 | Aug 23, 2026 |
| Oracle_linux | — | Upgrade rust-toolset-srpm-macrosUpgrade rustfmtUpgrade rust-std-static-wasm32-wasip1Upgrade rust-std-static-x86_64-unknown-noneUpgrade rust-analyzerUpgrade rust-gdbUpgrade rust-toolsetUpgrade rust-std-static-wasm32-unknown-unknownUpgrade rust-std-static-aarch64-unknown-none-softfloatUpgrade cargoUpgrade rust-docUpgrade rust-lldbUpgrade rust-srcUpgrade rust-debugger-commonUpgrade rustUpgrade clippyUpgrade rust-std-static | Oct 22, 2026 | Aug 20, 2026 |
| Redhat_linux | — | Upgrade rust-analyzer-debuginfoUpgrade rust-std-static-x86_64-unknown-noneNo solution existsUpgrade rust-toolsetUpgrade rust-gdbUpgrade rust-std-static-wasm32-unknown-unknownUpgrade rust-toolset-srpm-macrosUpgrade rust-std-static-wasm32-wasip1Upgrade rust-analyzerUpgrade rustfmtUpgrade rust-srcUpgrade clippy-debuginfoUpgrade rustUpgrade rust-std-static-debuginfoUpgrade rust-std-staticUpgrade rustfmt-debuginfoUpgrade rust-debugger-commonUpgrade rust-debugsourceUpgrade clippyUpgrade cargo-debuginfoUpgrade cargoUpgrade rust-lldbUpgrade rust-docUpgrade rust-debuginfo | Aug 25, 2026 | Aug 20, 2026 |
| Rocky_linux | — | Upgrade rust-debuginfoUpgrade rust-debugsourceUpgrade rustfmt-debuginfoUpgrade clippyUpgrade clippy-debuginfoUpgrade cargoUpgrade rust-analyzerUpgrade rustfmtUpgrade rust-docUpgrade rustUpgrade rust-std-staticUpgrade cargo-debuginfoUpgrade rust-analyzer-debuginfoUpgrade rust-std-static-debuginfo | Sep 17, 2026 | Sep 15, 2026 |
| Ubuntu | — | Upgrade libgit2-26 (Ubuntu Pro)Upgrade libgit2-28 (Ubuntu Pro)Upgrade libgit2-1.1 (Ubuntu Pro)Upgrade libgit2-devUpgrade libgit2-fixturesUpgrade libgit2-fixtures (Ubuntu Pro)Upgrade libgit2-0 (Ubuntu Pro)Upgrade libgit2-24 (Ubuntu Pro)Upgrade libgit2-dev (Ubuntu Pro)Upgrade libgit2-1.9Upgrade libgit2-1.7No solution exists | Aug 13, 2026 | Aug 12, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub