SB2026072079 - Multiple vulnerabilities in libgit2

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072079

SB2026072079 - Multiple vulnerabilities in libgit2

Published: July 20, 2026

Security Bulletin ID SB2026072079
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 83% Low 17%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-53585)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in git_delta_apply() when processing delta object headers in pack data. A remote attacker can supply a specially crafted pack file or malicious repository data to cause a denial of service.

The issue can be triggered through clone, fetch, indexer, or local repository pack processing, and multi-level OFS_DELTA chains can amplify memory consumption significantly.


2) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the bundled PCRE 8.45 regex compiler when parsing attacker-controlled revspec patterns through git_revparse_single. A remote attacker can supply a specially crafted revspec pattern to cause a denial of service.

The issue is reachable through revspecs of the form :/<pattern> in configurations using the built-in regex backend.


3) Out-of-bounds read (CVE-ID: CVE-2026-53587)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in set_data() in src/libgit2/transports/smart_pkt.c when parsing the first ref-pkt of a smart-protocol refs advertisement from a Git server. A remote attacker can send a specially crafted refs advertisement to cause a denial of service.

The issue is reachable before capability negotiation has taken place, and in some heap layouts the resulting error formatting may copy heap data into the error string.


4) Path traversal (CVE-ID: CVE-2026-53584)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to create directories outside the repository's working tree.

The vulnerability exists due to path traversal in submodule path handling when initializing a submodule in a crafted repository. A remote attacker can supply a crafted repository containing a submodule path with traversal components to create directories outside the repository's working tree.

User interaction is required to initialize a submodule in a crafted repository.


5) Insufficiently protected credentials (CVE-ID: CVE-2026-53586)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insufficiently protected credentials in the builtin HTTP transport when following an offsite redirect for the initial smart HTTP request and handling a 401 authentication challenge from the redirected server. A remote attacker can cause an initial offsite redirect from a trusted Git remote URL to disclose sensitive information.

User interaction is required to contact a trusted original URL for which the application is willing to provide credentials.


6) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-53583)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to bypass certificate hostname validation and perform a man-in-the-middle attack.

The vulnerability exists due to improper validation of a certificate with host mismatch in the verify_server_cert() function in src/libgit2/streams/openssl.c when verifying IP SubjectAltName entries for IP-literal HTTPS URLs. A remote attacker can present a valid CA-signed certificate containing any IP SAN to bypass certificate hostname validation and perform a man-in-the-middle attack.

Only libgit2 builds using the OpenSSL backend are affected, and exploitation requires connections to IP-literal HTTPS URLs rather than domain-name URLs.


Remediation

Install update from vendor's website.

References