Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2026-53587 EUVD-2026-63547

libgit2 - Unauthenticated network-reachable heap out-of-bounds read in transports/smart_pkt.c:set_data

Published Aug 20, 2026 · Updated Aug 20, 2026 · Assigned by GitHub_M

Vendor: libgit2 Product: libgit2 Package: libgit2 Package: libgit2 Package: libgit2 Package: libgit2 Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in versions 1.8.6 and 1.9.5.

Affected products

VendorProductAffectedFixed
libgit2 libgit2 < 1.8.6, >= 1.9.0, < 1.9.5 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 libgit2 1.9.6+ds-1 —
Debian 13 libgit2 1.9.0+ds-2+deb13u1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS libgit2 1.9.1+ds-1ubuntu1.1 —
Ubuntu 24.04 LTS libgit2 1.7.2+ds-1ubuntu3.1 —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 rust +16 1.92.0-2.el10_2 RHSA-2026:67286
RHEL 9 rust +13 1.92.0-2.el9_8 RHSA-2026:67285
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS rust +16 1.84.1-1.el10_0.4 RHSA-2026:69096
RHEL 9.6 EUS rust +13 1.84.1-1.el9_6.1 RHSA-2026:69109
RHEL 9.4 E4S rust +13 1.75.0-1.el9_4.1 RHSA-2026:69097
Red Hat Hardened Images 1 libgit2 +1 1.9.7-1.hum1 RHSA-2026:59361

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 rust +16 1.92.0-2.el10_2.alma.1 ALSA-2026:67286
AlmaLinux 9 rust +13 1.92.0-2.el9_8 ALSA-2026:67285

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 rust 1.92.0-2.el10_2 RLSA-2026:67286
Rocky Linux 9 rust 1.92.0-2.el9_8 RLSA-2026:67285

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed libgit2 1.9.6-1.1 openSUSE-SU-2026:11315-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 libgit2 1.9.6-r0 —
Alpine v3.23 libgit2 1.9.6-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 cargo-c 0.10.21-1.amzn2023.0.1 ALAS2023-2026-2064
Amazon Linux 2023 libgit2 +1 1.6.4-116.amzn2023 ALAS2023-2026-2083
Amazon Linux 2023 network-flow-monitor-agent 1.1.8-1.amzn2023.0.1 ALAS2023-2026-3116
Amazon Linux 2023 rust +14 1.97.0-2.amzn2023 ALAS2023-2026-2065
Amazon Linux 2 rust +11 1.97.0-2.amzn2 ALAS2-2026-3865

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 libgit2 1.7.2-3 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 17

References