Description
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in versions 1.8.6 and 1.9.5.
Published: 2026-08-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw is an unauthenticated, network‑reachable heap out‑of‑bounds read that can occur during the first refs‑advertisement packet sent by a Git server. When the library processes a malicious packet, the bounds check in the smart‑protocol pkt‑line handling fails, causing an overflow of the format string pointer. The result is a heap read that can crash the client, leading to a denial‑of‑service condition but not to arbitrary code execution.

Affected Systems

The issue affects projects using the libgit2 library before version 1.8.6 and before 1.9.5. The library is a portable C implementation of Git that is typically linked into applications that implement Git functionality. Users of any version of libgit2 that is older than these releases are vulnerable.

Risk and Exploitability

The CVSS score is 7.5, indicating substantial risk. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Attackers can remotely exploit the weakness by hosting a malicious Git server that sends a crafted packet over HTTP, HTTPS, SSH, or the Git protocol; no user authentication is required. The exploitation results in a client crash and interruption of services, and there is no evidence that the vulnerability permits remote code execution.

Generated by OpenCVE AI on August 21, 2026 at 01:30 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade libgit2 to version 1.8.6 or newer
  • Rebuild all dependent applications to link against the updated library
  • Test client connections to a Git server to verify that crashes no longer occur

Generated by OpenCVE AI on August 21, 2026 at 01:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6453-1 libgit2 security update
History

Mon, 24 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 20 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Libgit2
Libgit2 libgit2
Vendors & Products Libgit2
Libgit2 libgit2

Thu, 20 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
Description libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in versions 1.8.6 and 1.9.5.
Title libgit2 - Unauthenticated network-reachable heap out-of-bounds read in transports/smart_pkt.c:set_data
Weaknesses CWE-125
CWE-126
CWE-1284
CWE-20
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Libgit2 Libgit2
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-20T19:18:33.821Z

Reserved: 2026-06-09T19:11:53.484Z

Link: CVE-2026-53587

cve-icon Vulnrichment

Updated: 2026-08-20T19:18:12.597Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-20T19:16:55.137

Modified: 2026-09-09T21:19:49.197

Link: CVE-2026-53587

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-20T18:36:43Z

Links: CVE-2026-53587 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T01:45:08Z

Weaknesses
  • CWE-125

    Out-of-bounds Read

  • CWE-126

    Buffer Over-read

  • CWE-1284

    Improper Validation of Specified Quantity in Input

  • CWE-20

    Improper Input Validation