Out-of-bounds read in libgit2 - CVE-2026-53587
Published: July 20, 2026
Vulnerability identifier: #VU138487
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-53587
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: libgit2.github.com
Affected software:
libgit2
libgit2
Detailed vulnerability description
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds read in set_data() in src/libgit2/transports/smart_pkt.c when parsing the first ref-pkt of a smart-protocol refs advertisement from a Git server. A remote attacker can send a specially crafted refs advertisement to cause a denial of service.
The issue is reachable before capability negotiation has taken place, and in some heap layouts the resulting error formatting may copy heap data into the error string.
How to mitigate CVE-2026-53587
Install security update from vendor's website.