EUVD-2026-63546

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affect...

CVE-2026-53584

libgit2 (a portable C implementation of Git core methods) is vulnerable to submodule path traversal in versions prior to 1.8.6 and 1.9.5 . The affected code paths in src/libgit2/submodule.c (git_submodule_lookup and git_submodule_add_setup) fail to reject traversal components (e.g., ../) in submo...

CVE-2026-53584 libgit2: Submodule path traversal

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affect...

CVE-2026-53584

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affect...

[SECURITY] Fedora 43 Update: libgit2-1.9.7-1.fc43

libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant linkable library with a solid API, allowing you to write native speed custom Git applications in any language with bindings...

[SECURITY] [DSA 6453-1] libgit2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6453-1 [email protected] https://www.debian.org/security/ Aron Xu August 20, 2026 https://www.debian.org/security/faq -...

Debian dsa-6453 : libgit2-1.9 - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6453 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6453-1 [email protected] https://www.debian.org/securit...

Fedora 43 : libgit2 (2026-60e31281d5)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-60e31281d5 advisory. Update to version 1.9.7. Release notes: https://github.com/libgit2/libgit2/releases/tag/v1.9.7 Tenable has extracted the preceding description block directly...

CVE-2026-53583: Improper Certificate Validation

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verifyservercert in src/libgit2/streams/openssl.c uses an inverted !!memcmp result in the GENIPADD...

CVE-2026-53585: Allocation of Resources Without Limits or Throttling

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, gitdeltaapply in src/libgit2/delta.c trusts the attacker-controlled ressz value parsed by hdrsz from...

CVE-2026-53584: Improper Limitation of a Pathname to a Restricted Directory

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affect...

CVE-2026-53586: Exposure of Sensitive Information to an Unauthorized Actor

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in HTTP transport in src/libgit2/transports/http.c follows an offsite initial redirect, an...

CVE-2026-53587: Improper Input Validation

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in setdata in src/libgit2/transports/smartpkt.c without first...

[SECURITY] Fedora 44 Update: libgit2-1.9.7-1.fc44

libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant linkable library with a solid API, allowing you to write native speed custom Git applications in any language with bindings...

Fedora 44 : libgit2 (2026-86684eb696)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-86684eb696 advisory. Update to version 1.9.7. Release notes: https://github.com/libgit2/libgit2/releases/tag/v1.9.7 Tenable has extracted the preceding description block directly...

Amazon Linux 2023 : cargo-c (ALAS2023-2026-2064)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2064 advisory. libgit2 Submodule path traversal CVE-2026-53584 Unbounded Memory Allocation via Delta Object Result-Size Header CVE-2026-53585 libgit2 version 1.9.4 and below is vulnerable to a heap...

Amazon Linux 2 : rust, --advisory ALAS2-2026-3865 (ALAS-2026-3865)

The version of rust installed on the remote host is prior to 1.97.0-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3865 advisory. RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time...

ANT-2026-RVPC18B1 · libgit2 · Heap Buffer Overflow

heap-buffer-overflow medium GHSA-wfx7-g85r-q6vw Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-RVPC18B1: Heap buffer...

Important: rust-cargo-c

Issue Overview: libgit2 Submodule path traversal CVE-2026-53584 Unbounded Memory Allocation via Delta Object Result-Size Header CVE-2026-53585 libgit2 version 1.9.4 and below is vulnerable to a heap out-of-bounds read in setdata in src/libgit2/transports/smartpkt.c. The vulnerable code uses a...

Fedora 43 : rust-bat / rust-git-delta / rust-git-interactive-rebase-tool / etc (2026-7ebec18d52)

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-7ebec18d52 advisory. Rebuild applications that use libgit2 via the Rust bindings git2 / libgit2-sys crates with the latest version of the libgit2-sys crate. This ensures...