Out-of-bounds read in libgit2 - CVE-2026-53587

Vulnerability identifier: #VU138487

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-53587

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in set_data() in src/libgit2/transports/smart_pkt.c when parsing the first ref-pkt of a smart-protocol refs advertisement from a Git server. A remote attacker can send a specially crafted refs advertisement to cause a denial of service.

The issue is reachable before capability negotiation has taken place, and in some heap layouts the resulting error formatting may copy heap data into the error string.

libgit2
Debian Linux
Fedora
Ubuntu
rust-pretty-git-prompt
rust-libgit2-sys
libgit2 (Ubuntu package)
rust-git-delta
rust-bat
rust-lsd
libgit2 (Debian package)
libgit2_1.9
libgit2
rust-git-interactive-rebase-tool
rust-tokei

Install security update from vendor's website.

libgit2 - update to 1.9.5
rust-pretty-git-prompt - addressed in versions 0.2.2-11.fc43, 0.2.2-11.fc44
rust-libgit2-sys - addressed in versions 0.18.7-1.el9, 0.18.7-1.el10_3, 0.18.7-1.fc43, 0.18.7-1.fc44, 0.18.7-1.fc45
libgit2 (Ubuntu package) - addressed in versions 0.19.0-2ubuntu0.4+esm2, 0.24.1-2ubuntu0.2+esm3, 0.26.0+dfsg.1-1.1ubuntu0.2+esm2, 0.28.4+dfsg.1-2ubuntu0.1+esm1, 1.1.0+dfsg.1-4.1ubuntu0.1+esm1, 1.7.2+ds-1ubuntu3.1, 1.9.1+ds-1ubuntu1.1
rust-git-delta - addressed in versions 0.19.1-7.el9, 0.19.1-7.el10_3, 0.19.1-7.fc43, 0.19.1-7.fc44
rust-bat - addressed in versions 0.26.1-2.el9, 0.26.1-3.el10_3, 0.26.1-3.fc43, 0.26.1-3.fc44
rust-lsd - addressed in versions 1.2.0-8.el9, 1.2.0-8.el10_2, 1.2.0-8.el10_3, 1.2.0-8.fc43, 1.2.0-8.fc44
libgit2 (Debian package) - update to 1.9.0+ds-2+deb13u1
libgit2_1.9 - addressed in versions 1.9.6-1.el9, 1.9.6-1.el10_3, 1.9.6-1.fc45
libgit2 - addressed in versions 1.9.6-1.fc43, 1.9.6-1.fc44
rust-git-interactive-rebase-tool - addressed in versions 2.4.1-17.fc43, 2.4.1-17.fc44
rust-tokei - addressed in versions 14.0.0-7.el9, 14.0.0-7.el10_3, 14.0.0-7.fc43, 14.0.0-7.fc44

• https://github.com/libgit2/libgit2/security/advisories/GHSA-pm24-4jhq-3xvm

• Multiple vulnerabilities in libgit2
• Fedora 45 update for libgit2_1.9, rust-libgit2-sys
• Fedora 44 update for libgit2, rust-libgit2-sys
• Fedora 43 update for libgit2, rust-libgit2-sys
• Fedora EPEL 10.3 update for libgit2_1.9, rust-libgit2-sys
• Fedora EPEL 9 update for libgit2_1.9, rust-libgit2-sys
• Ubuntu update for libgit2
• Fedora EPEL 10.3 update for rust-bat, rust-git-delta, rust-lsd, rust-tokei
• Fedora 44 update for rust-bat, rust-git-delta, rust-git-interactive-rebase-tool, rust-lsd, rust-pretty-git-prompt, rust-tokei
• Fedora 43 update for rust-bat, rust-git-delta, rust-git-interactive-rebase-tool, rust-lsd, rust-pretty-git-prompt, rust-tokei
• Fedora EPEL 9 update for rust-bat, rust-git-delta, rust-lsd, rust-tokei
• Fedora EPEL 10.2 update for rust-lsd
• Debian update for libgit2