In ng_pkt in transports/smart_pkt.c in libgit2 before 0.26.6 and 0.27.x before 0.27.4, a remote attacker can send a crafted smart-protocol "ng" packet that lacks a '\0' byte to trigger an out-of-bounds read that leads to DoS.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libgit2-0.27Upgrade libgit2-1.0Upgrade libgit2-1.1Upgrade libgit2 | Aug 22, 2024 | Aug 18, 2018 |
| Debian | — | Upgrade libgit2 | Feb 19, 2019 | Aug 17, 2018 |
| Suse | — | Upgrade libgit2-24Upgrade libgit2-develUpgrade libgit2-26-32bitUpgrade libgit2-26 | Aug 25, 2018 | Aug 17, 2018 |
| Ubuntu | — | Upgrade libgit2-dev (Ubuntu Pro)Upgrade libgit2-1.9Upgrade libgit2-24 (Ubuntu Pro)No solution existsUpgrade libgit2-1.7Upgrade libgit2-fixturesUpgrade libgit2-26 (Ubuntu Pro)Upgrade libgit2-fixtures (Ubuntu Pro)Upgrade libgit2-1.1 (Ubuntu Pro)Upgrade libgit2-28 (Ubuntu Pro)Upgrade libgit2-devUpgrade libgit2-0 (Ubuntu Pro) | Jun 26, 2025 | Aug 18, 2018 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub