Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-53587: libgit2 version 1.9.4 and below is vulnerable to a heap out-of-bounds read in set_data() in src/libgit2/transports/smart_pkt.c. The vulnerable code uses a fixed-size strncmp (smart_pkt.c:239) against the unvalidated capability buffer of a smart-protocol pkt-line. When the bytes following the pkt-line in the contiguous receive buffer happen to continue with "ct-format=", the comparison spuriously matches, advancing format_str past the pkt-line boundary. The following memchr(format_str, ' ', len - (format_str - line)) (smart_pkt.c:246) then underflows its size_t size argument to ~SIZE_MAX and walks the heap looking for a space byte. An unauthenticated remote attacker who controls (or man-in-the-middles) a Git server reached over HTTP/HTTPS/SSH/git:// can trigger this on the FIRST ref-pkt of the refs advertisement, before any capability negotiation has taken place. The OOB walk causes a process crash (SIGSEGV) when memchr enters an unmapped page, and -- on heap layouts where memchr finds a stray space byte before crashing -- can additionally drive the git_error_set("...'%.*s'", format_len, format_str) formatter to copy a large window of heap memory into the error string. CVE-2026-53586: libgit2's builtin HTTP transport follows offsite redirects for the initial smart HTTP request by default. If the redirected server then returns 401 Unauthorized, libgit2 asks the application credential callback for credentials using the original remote URL, not the redirected URL. The returned credential is then attached to the next request to the redirected host as an Authorization header. CVE-2026-53585: Unbounded Memory Allocation via Delta Object Result-Size Header CVE-2026-53584: libgit2 Submodule path traversal CVE-2026-53583: libgit2 Inverted IP SubjectAltName Comparison in OpenSSL Backend ( vuln_1_1_1 ) CVE-2026-50185: RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. From 0.1.1 until 0.5.4, the aarch64 implementations of Cmov and CmovEq in cmov/src/backends/aarch64.rs assume high bits are zero-extended when loading values smaller than a register, so set high bits such as [8..] in a Cmov selector or [16..] of self or other in the u16 and i16 CmovEq implementations can cause left.cmovz(&right, condition) to produce incorrect output. This issue is fixed in version 0.5.4.
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | cargo | 0:1.97.0-2.amzn2 |
| Amazon Linux · 2 | clippy | 0:1.97.0-2.amzn2 |
| Amazon Linux · 2 | rust | 0:1.97.0-2.amzn2 |
| Amazon Linux · 2 | rust-analyzer | 0:1.97.0-2.amzn2 |
| Amazon Linux · 2 | rust-debugger-common | 0:1.97.0-2.amzn2 |
| Amazon Linux · 2 | rust-doc | 0:1.97.0-2.amzn2 |
| Amazon Linux · 2 | rust-gdb | 0:1.97.0-2.amzn2 |
| Amazon Linux · 2 | rust-src | 0:1.97.0-2.amzn2 |
| Amazon Linux · 2 | rust-std-static | 0:1.97.0-2.amzn2 |
| Amazon Linux · 2 | rust-toolset | 0:1.97.0-2.amzn2 |
| Amazon Linux · 2 | rust-toolset-srpm-macros | 0:1.97.0-2.amzn2 |
| Amazon Linux · 2 | rustfmt | 0:1.97.0-2.amzn2 |
Vulnerabilities 6
-
High 7.5CVE-2026-53587 Public exploit
libgit2 - Unauthenticated network-reachable heap out-of-bounds read in transports/smart_pkt.c:set_data
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgi…
-
Medium 6.5
libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Backend
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verify_server_cert in src/libgit2/streams/openssl.c uses an in…
-
Medium 6.5
libgit2: HTTP transport can leak credentials to an offsite redirect target
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in HTTP transport in src/libgit2/transports/http.c f…
-
Medium 5.3
libgit2: Unbounded Memory Allocation via Delta Object Result-Size Header
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, git_delta_apply in src/libgit2/delta.c trusts the attacker-con…
-
Medium 4.3
libgit2: Submodule path traversal
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule pa…
-
Low 2.0
RustCrypto Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set
RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. From 0.1.1 until 0.5.4, the aarch64 implementations of Cmov and CmovEq in cmov/src/b…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-50185.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53583.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53584.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53585.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53586.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53587.html