SB2026081715 - Fedora 44 update for rust-bat, rust-git-delta, rust-git-interactive-rebase-tool, rust-lsd, rust-pretty-git-prompt, rust-tokei
Published: August 17, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 vulnerabilities.
1) OS Command Injection (CVE-ID: CVE-2026-5917)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary commands on the SSH server.
The vulnerability exists due to command injection in the libssh2 SSH backend gen_proto() function when processing a repository path containing an unescaped single quote. A remote attacker can supply a specially crafted SSH repository URL or submodule URL to execute arbitrary commands on the SSH server.
User interaction is required to clone or update content referencing the crafted SSH URL, and exploitation requires the target SSH account to use an ordinary login shell rather than a restricted command handler.
2) Insufficiently protected credentials (CVE-ID: CVE-2026-53586)
CWE-ID: CWE-522 - Insufficiently Protected Credentials
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to insufficiently protected credentials in the builtin HTTP transport when following an offsite redirect for the initial smart HTTP request and handling a 401 authentication challenge from the redirected server. A remote attacker can cause an initial offsite redirect from a trusted Git remote URL to disclose sensitive information.
User interaction is required to contact a trusted original URL for which the application is willing to provide credentials.
3) Out-of-bounds read (CVE-ID: CVE-2026-53587)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds read in set_data() in src/libgit2/transports/smart_pkt.c when parsing the first ref-pkt of a smart-protocol refs advertisement from a Git server. A remote attacker can send a specially crafted refs advertisement to cause a denial of service.
The issue is reachable before capability negotiation has taken place, and in some heap layouts the resulting error formatting may copy heap data into the error string.
4) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-53585)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in git_delta_apply() when processing delta object headers in pack data. A remote attacker can supply a specially crafted pack file or malicious repository data to cause a denial of service.
The issue can be triggered through clone, fetch, indexer, or local repository pack processing, and multi-level OFS_DELTA chains can amplify memory consumption significantly.
5) Path traversal (CVE-ID: CVE-2026-53584)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to create directories outside the repository's working tree.
The vulnerability exists due to path traversal in submodule path handling when initializing a submodule in a crafted repository. A remote attacker can supply a crafted repository containing a submodule path with traversal components to create directories outside the repository's working tree.
User interaction is required to initialize a submodule in a crafted repository.
6) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-53583)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass certificate hostname validation and perform a man-in-the-middle attack.
The vulnerability exists due to improper validation of a certificate with host mismatch in the verify_server_cert() function in src/libgit2/streams/openssl.c when verifying IP SubjectAltName entries for IP-literal HTTPS URLs. A remote attacker can present a valid CA-signed certificate containing any IP SAN to bypass certificate hostname validation and perform a man-in-the-middle attack.
Only libgit2 builds using the OpenSSL backend are affected, and exploitation requires connections to IP-literal HTTPS URLs rather than domain-name URLs.
Remediation
Install update from vendor's website.