Read the docs
TI-2026-38647 Aliases CVE-2026-53587

libgit2 - Unauthenticated network-reachable heap out-of-bounds read in transports/smart_pkt.c:set_data

Priority HIGH 72CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 8 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.

Summary

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in versions 1.8.6 and 1.9.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0047 40th percentileScored 2026-11-07
Fix Partial libgit2 (libgit2): 1.8.6, 1.9.5Red Hat: 6 advisoriesRed Hat: 8 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
libgit2libgit2before 1.8.6; 1.9.0 to before 1.9.51.8.6, 1.9.5Patch availableCNA
  • libgit2 Vendorlibgit2 Affected before 1.8.6; 1.9.0 to before 1.9.5 Fixed in 1.8.6, 1.9.5 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:libgit2:libgit2:*:*:*:*:*:*:*:*——libgit2
  • cpe:2.3:a:libgit2:libgit2:*:*:*:*:*:*:*:* Versions — — ·libgit2

Remediation

  • Fix · CNA libgit2 (libgit2) Fixed in 1.8.6, 1.9.5

Red Hat 6 advisories

  • RHSA-2026:69109 Released 2026-09-21 · Red Hat rating Important
    rust security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) cargo-1.84.1-1.el9_6.1, clippy-1.84.1-1.el9_6.1, rust-1.84.1-1.el9_6.1 +11
  • RHSA-2026:69097 Released 2026-09-21 · Red Hat rating Important
    rust security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) cargo-1.75.0-1.el9_4.1, clippy-1.75.0-1.el9_4.1, rust-1.75.0-1.el9_4.1 +11
  • RHSA-2026:69096 Released 2026-09-21 · Red Hat rating Important
    rust security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) cargo-1.84.1-1.el10_0.4, clippy-1.84.1-1.el10_0.4, rust-1.84.1-1.el10_0.4 +12
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) rust-std-static-aarch64-unknown-none-softfloat-1.84.1-1.el10_0.4, rust-std-static-x86_64-unknown-none-1.84.1-1.el10_0.4
Show 3 more Red Hat advisories
  • RHSA-2026:67285 Released 2026-09-14 · Red Hat rating Important
    rust security update
    • Red Hat Enterprise Linux AppStream (v. 9) cargo-1.92.0-2.el9_8, clippy-1.92.0-2.el9_8, rust-1.92.0-2.el9_8 +11
  • RHSA-2026:67286 Released 2026-09-14 · Red Hat rating Important
    rust security update
    • Red Hat Enterprise Linux AppStream (v. 10) cargo-1.92.0-2.el10_2, clippy-1.92.0-2.el10_2, rust-1.92.0-2.el10_2 +12
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) rust-std-static-aarch64-unknown-none-softfloat-1.92.0-2.el10_2, rust-std-static-x86_64-unknown-none-1.92.0-2.el10_2
  • RHSA-2026:59361 Released 2026-08-25 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images libgit2-1.9.7-1.hum1@aarch64, libgit2-1.9.7-1.hum1@src, libgit2-1.9.7-1.hum1@x86_64 +2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:67286
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:67285
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:69097
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:69096
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:69109
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:67286
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:69096
Red Hat Hardened ImagesFixed RHSA-2026:59361

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53587

References

Other 6

  • TI-2014-07619 Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x… CVSS 3.1CRITICAL 9.8
  • TI-2026-38643 libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Backend CVSS 3.1MEDIUM 6.5
  • TI-2026-38645 libgit2: Unbounded Memory Allocation via Delta Object Result-Size Header CVSS 3.1MEDIUM 5.3
  • TI-2024-16198 libgit2 is vulnerable to arbitrary code execution due to heap corruption in `git_index_add` CVSS 3.1CRITICAL 9.8
  • TI-2020-09811 An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. CVSS 3.1CRITICAL 9.8
  • TI-2020-09810 An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. CVSS 3.1CRITICAL 9.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences