The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libgit2 | Aug 21, 2026 | Aug 20, 2026 |
| Amazon Linux Ami 2 | — | Upgrade rust-gdbUpgrade rust-docUpgrade cargoUpgrade rust-std-staticUpgrade rust-toolsetUpgrade rust-srcUpgrade clippyUpgrade rustUpgrade rust-toolset-srpm-macrosUpgrade rust-debugger-commonUpgrade rustfmtUpgrade rust-analyzer | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade mount-s3-debugsourceUpgrade rust-srcUpgrade libgit2Upgrade rustfmtUpgrade rust-lldbUpgrade rust-debugsourceUpgrade rust-docUpgrade rust-gdbUpgrade rust-std-static-wasm32-wasip1Upgrade rust-toolsetUpgrade cargoUpgrade rust-analyzer-debuginfoUpgrade rust-analyzerUpgrade rust-cargo-c-debugsourceUpgrade mount-s3Upgrade rust-std-static-wasm32-unknown-unknownUpgrade mount-s3-debuginfoUpgrade cargo-debuginfoUpgrade rustfmt-debuginfoUpgrade cargo-c-debuginfoUpgrade cargo-cUpgrade clippy-debuginfoUpgrade libgit2-debugsourceUpgrade rust-debuginfoUpgrade rust-std-staticUpgrade clippyUpgrade libgit2-develUpgrade rust-toolset-srpm-macrosUpgrade libgit2-debuginfoUpgrade rust-debugger-commonUpgrade rust | Aug 21, 2026 | Aug 20, 2026 |
| Debian | — | Upgrade libgit2 | Aug 23, 2026 | Aug 20, 2026 |
| Redhat_linux | — | No solution exists | Aug 25, 2026 | Aug 20, 2026 |
| Ubuntu | — | Upgrade libgit2-0 (Ubuntu Pro)Upgrade libgit2-fixturesUpgrade libgit2-26 (Ubuntu Pro)Upgrade libgit2-1.1 (Ubuntu Pro)Upgrade libgit2-devUpgrade libgit2-fixtures (Ubuntu Pro)Upgrade libgit2-28 (Ubuntu Pro)Upgrade libgit2-1.7Upgrade libgit2-dev (Ubuntu Pro)Upgrade libgit2-1.9No solution existsUpgrade libgit2-24 (Ubuntu Pro) | Aug 13, 2026 | Aug 12, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub