Skip to content
OpenAdvisories
High RHSA-2026:59361 5 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Aug 25, 2026 · Updated Oct 6, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 libgit2 0:1.9.7-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 libgit2-devel 0:1.9.7-1.hum1

Vulnerabilities 5

  • High 7.5
    CVE-2026-53587 Public exploit

    libgit2 - Unauthenticated network-reachable heap out-of-bounds read in transports/smart_pkt.c:set_data

    libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgi…

    libgit2 libgit2 libgit2 libgit2 Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2026-53583

    libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Backend

    libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verify_server_cert in src/libgit2/streams/openssl.c uses an in…

    libgit2 libgit2 libgit2 libgit2 Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2026-53586

    libgit2: HTTP transport can leak credentials to an offsite redirect target

    libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in HTTP transport in src/libgit2/transports/http.c f…

    libgit2 libgit2 libgit2 libgit2 Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2026-53585

    libgit2: Unbounded Memory Allocation via Delta Object Result-Size Header

    libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, git_delta_apply in src/libgit2/delta.c trusts the attacker-con…

    libgit2 libgit2 libgit2 libgit2 Debian Ubuntu Azure Linux Alpine
  • Medium 4.3
    CVE-2026-53584

    libgit2: Submodule path traversal

    libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule pa…

    libgit2 libgit2 libgit2 libgit2 Debian Ubuntu Azure Linux Alpine

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-53587
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-53586
  • report
    https://access.redhat.com/security/cve/CVE-2026-53584
  • report
    https://access.redhat.com/security/cve/CVE-2026-53585
  • report
    https://access.redhat.com/security/cve/CVE-2026-53583
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59361.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2520694
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53583
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53583
  • article
    https://github.com/libgit2/libgit2/commit/647dcb432980b84ede4cb5a008bbd1ccb4ead03d
  • article
    https://github.com/libgit2/libgit2/commit/c2aa35409ee0e6515df64da49750f13a0a42c47f
  • article
    https://github.com/libgit2/libgit2/commit/ef086bc3e4eedf62be38a910381aae24d49871ff
  • article
    https://github.com/libgit2/libgit2/releases/tag/v1.8.6
  • article
    https://github.com/libgit2/libgit2/releases/tag/v1.9.5
  • article
    https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2520695
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53584
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53584
  • article
    https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1
  • article
    https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c
  • article
    https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4
  • article
    https://github.com/libgit2/libgit2/security/advisories/GHSA-cw77-j82w-mchm
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2520696
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53585
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53585
  • article
    https://github.com/libgit2/libgit2/commit/0cdfdd5fa8f8514c82413025e1e0808866cf7c30
  • article
    https://github.com/libgit2/libgit2/commit/c1896f06df22cc0ca5658df3a8f6cd7ede4cd6ae
  • article
    https://github.com/libgit2/libgit2/commit/dec22ac01ad9620c96b7b9ac3ef636ea46d43bed
  • article
    https://github.com/libgit2/libgit2/security/advisories/GHSA-27m5-gxxh-x79j
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2520691
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53586
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53586
  • article
    https://github.com/libgit2/libgit2/commit/07de6a7e438f95ac9a6efd3222a82117e871ed27
  • article
    https://github.com/libgit2/libgit2/commit/af2b29ad0a74d5bac9751376879ddaf848136d3b
  • article
    https://github.com/libgit2/libgit2/commit/c1507abc44647b3acd832a33a5b1c8c9f5ba8821
  • article
    https://github.com/libgit2/libgit2/security/advisories/GHSA-2889-x8f6-mc4x
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2520693