libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in versions 1.8.6 and 1.9.5.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libgit2 | Aug 21, 2026 | Aug 20, 2026 |
| Amazon_linux_2023 | — | Upgrade rust-gdbUpgrade clippy-debuginfoUpgrade rust-toolsetUpgrade rust-lldbUpgrade rust-cargo-c-debugsourceUpgrade rust-std-static-wasm32-unknown-unknownUpgrade libgit2-develUpgrade rust-std-static-wasm32-wasip1Upgrade cargo-debuginfoUpgrade network-flow-monitor-agentUpgrade rust-debugsourceUpgrade rust-analyzerUpgrade cargo-cUpgrade libgit2Upgrade cargoUpgrade rust-toolset-srpm-macrosUpgrade network-flow-monitor-agent-debuginfoUpgrade rustUpgrade libgit2-debuginfoUpgrade rustfmtUpgrade rust-srcUpgrade rust-analyzer-debuginfoUpgrade rust-debuginfoUpgrade clippyUpgrade cargo-c-debuginfoUpgrade rust-docUpgrade rust-debugger-commonUpgrade rust-std-staticUpgrade rustfmt-debuginfoUpgrade libgit2-debugsourceUpgrade network-flow-monitor-agent-debugsource | Aug 21, 2026 | Aug 20, 2026 |
| Debian | — | Upgrade libgit2 | Aug 23, 2026 | Aug 23, 2026 |
| Redhat_linux | — | Upgrade rustUpgrade rust-std-static-debuginfoUpgrade rust-debugsourceUpgrade rust-debugger-commonUpgrade cargoUpgrade rust-lldbUpgrade rust-debuginfoUpgrade rustfmt-debuginfoUpgrade rust-docUpgrade clippy-debuginfoUpgrade rust-std-staticUpgrade clippyUpgrade cargo-debuginfoUpgrade rust-analyzerUpgrade rust-std-static-wasm32-unknown-unknownUpgrade rust-std-static-x86_64-unknown-noneUpgrade rustfmtUpgrade rust-srcUpgrade rust-gdbUpgrade rust-toolset-srpm-macrosNo solution existsUpgrade rust-std-static-wasm32-wasip1Upgrade rust-toolsetUpgrade rust-analyzer-debuginfo | Aug 25, 2026 | Aug 20, 2026 |
| Rocky_linux | — | Upgrade rust-std-static-debuginfoUpgrade rust-analyzer-debuginfoUpgrade clippyUpgrade cargo-debuginfoUpgrade cargoUpgrade rust-debugsourceUpgrade clippy-debuginfoUpgrade rustfmt-debuginfoUpgrade rust-analyzerUpgrade rustUpgrade rust-debuginfoUpgrade rust-docUpgrade rust-std-staticUpgrade rustfmt | Sep 17, 2026 | Sep 15, 2026 |
| Ubuntu | — | Upgrade libgit2-26 (Ubuntu Pro)Upgrade libgit2-1.1 (Ubuntu Pro)Upgrade libgit2-28 (Ubuntu Pro)Upgrade libgit2-devUpgrade libgit2-fixturesUpgrade libgit2-fixtures (Ubuntu Pro)Upgrade libgit2-0 (Ubuntu Pro)Upgrade libgit2-1.7Upgrade libgit2-24 (Ubuntu Pro)Upgrade libgit2-1.9Upgrade libgit2-dev (Ubuntu Pro)No solution exists | Aug 13, 2026 | Aug 12, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub