libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in versions 1.8.6 and 1.9.5.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libgit2 | Aug 21, 2026 | Aug 20, 2026 |
| Amazon_linux_2023 | — | Upgrade rust-std-static-wasm32-unknown-unknownUpgrade cargo-debuginfoUpgrade rust-gdbUpgrade rust-std-static-wasm32-wasip1Upgrade rust-lldbUpgrade clippy-debuginfoUpgrade libgit2-develUpgrade rust-toolsetUpgrade rust-cargo-c-debugsourceUpgrade rust-debugsourceUpgrade rust-analyzerUpgrade rust-docUpgrade clippyUpgrade cargoUpgrade cargo-c-debuginfoUpgrade rust-debuginfoUpgrade rust-srcUpgrade libgit2-debugsourceUpgrade rustfmt-debuginfoUpgrade rust-analyzer-debuginfoUpgrade rustUpgrade rust-std-staticUpgrade rust-debugger-commonUpgrade libgit2-debuginfoUpgrade cargo-cUpgrade rustfmtUpgrade libgit2Upgrade rust-toolset-srpm-macros | Aug 21, 2026 | Aug 20, 2026 |
| Debian | — | Upgrade libgit2 | Aug 23, 2026 | Aug 23, 2026 |
| Redhat_linux | — | Upgrade cargoUpgrade rust-std-staticUpgrade rust-std-static-debuginfoUpgrade clippy-debuginfoUpgrade rustUpgrade rust-docUpgrade rust-lldbUpgrade rust-debugsourceUpgrade clippyUpgrade rust-debugger-commonUpgrade rustfmt-debuginfoUpgrade rust-debuginfoUpgrade cargo-debuginfoNo solution existsUpgrade rust-toolsetUpgrade rust-analyzerUpgrade rust-std-static-wasm32-wasip1Upgrade rust-std-static-x86_64-unknown-noneUpgrade rust-srcUpgrade rust-toolset-srpm-macrosUpgrade rust-analyzer-debuginfoUpgrade rust-std-static-wasm32-unknown-unknownUpgrade rustfmtUpgrade rust-gdb | Aug 25, 2026 | Aug 20, 2026 |
| Rocky_linux | — | Upgrade rustUpgrade cargo-debuginfoUpgrade rust-debuginfoUpgrade rust-docUpgrade rustfmt-debuginfoUpgrade rust-analyzerUpgrade rust-std-staticUpgrade clippyUpgrade rust-debugsourceUpgrade rustfmtUpgrade clippy-debuginfoUpgrade cargoUpgrade rust-std-static-debuginfoUpgrade rust-std-static-x86_64-unknown-noneUpgrade rust-analyzer-debuginfo | Sep 17, 2026 | Sep 15, 2026 |
| Ubuntu | — | Upgrade libgit2-dev (Ubuntu Pro)Upgrade libgit2-1.7Upgrade libgit2-1.9Upgrade libgit2-24 (Ubuntu Pro)No solution existsUpgrade libgit2-fixtures (Ubuntu Pro)Upgrade libgit2-devUpgrade libgit2-1.1 (Ubuntu Pro)Upgrade libgit2-fixturesUpgrade libgit2-26 (Ubuntu Pro)Upgrade libgit2-28 (Ubuntu Pro)Upgrade libgit2-0 (Ubuntu Pro) | Aug 13, 2026 | Aug 12, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub