Gitmails

Development - IMPORTANT This Gitmails version is no longer maintained. Check out the Gitmails Shell port if you want to use a version that is maintained and, hopefully, developed. If you do not want to use the shell port and prefer the Python version, feel free to fork Gitmails and direct it to...

The vulnerability of the set_data() function in the src/libgit2/transports/smart_pkt.c file, which implements Git methods in the C language, allows a hacker to cause a service failure.

The vulnerability of the setdata function in the src/libgit2/transports/smartpkt.c file, which implements Git methods in C language, is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to cause service failures...

CVE-2026-53585 affecting package libgit2 for versions less than 1.7.2-2

CVE-2026-53585 affecting package libgit2 for versions less than 1.7.2-2. A patched version of the package is available...

libgit2: libgit2: Information disclosure via HTTP redirect allows credential leakage

A flaw was found in libgit2. The built-in HTTP transport component incorrectly handles offsite redirects, leading to the disclosure of sensitive information. An attacker controlling a trusted Git host or an open redirect on that host could exploit this by causing the library to send HTTP Basic...

libgit2: libgit2: Network attacker can intercept HTTPS connections via inverted IP SubjectAltName comparison

A flaw was found in libgit2, a C library for Git functionality. An inverted comparison in the OpenSSL backend's certificate verification logic, specifically when handling IP-literal hosts and certificate IP SubjectAltNames, allows a network attacker to intercept HTTPS connections. By presenting a...

libgit2: libgit2: Submodule path traversal allows arbitrary directory creation

A flaw was found in libgit2. This vulnerability allows a remote attacker to create directories outside of the intended repository working tree. By crafting a malicious repository that specifies traversal components in a submodule path, applications initializing the submodule can be tricked into...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: libgit2: libgit2-1.9.7-1.hum1 aarch64, x8664 libgit2-devel-1.9.7-1.hum1 aarch64, x8664 libgit2-1.9.7-1.hum1.src src...

libgit2: libgit2: Denial of Service due to heap out-of-bounds read from malicious Git server

A flaw was found in libgit2. A fixed-size string comparison in the setdata function within transports/smartpkt.c does not adequately verify the size of a network packet buffer. A remote attacker, operating a malicious Git server, can send a specially crafted packet-line capability buffer. This ca...

libgit2: libgit2: Denial of Service via Unbounded Memory Allocation

A flaw was found in libgit2. The gitdeltaapply function incorrectly trusts an attacker-controlled size value from a delta object header, which is used for memory allocation before proper validation of delta instructions. A remote attacker or local user can supply malicious pack data, for example,...

Astra Linux – Vulnerability in libgit2

A issue was discovered in libgit2 before versions 0.28.4 and 0.9x before version 0.99.0. path.c improperly handles equivalent filenames that exist due to NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352...

Astra Linux – Vulnerability in libgit2

A issue was discovered in libgit2 before versions 0.28.4 and 0.9x before version 0.99.0. The checkout.c file mishandles equivalent filenames that exist due to NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353...

Astra Linux – Vulnerability in libgit2

libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Previous versions of libgit2 required the caller to set the certificatecheck field of the libgit2’s...

CVE-2026-53586

A flaw was found in libgit2. The built-in HTTP transport component incorrectly handles offsite redirects, leading to the disclosure of sensitive information. An attacker controlling a trusted Git host or an open redirect on that host could exploit this by causing the library to send HTTP Basic...

CVE-2026-53585

A flaw was found in libgit2. The gitdeltaapply function incorrectly trusts an attacker-controlled size value from a delta object header, which is used for memory allocation before proper validation of delta instructions. A remote attacker or local user can supply malicious pack data, for example,...

CVE-2026-53583

A flaw was found in libgit2, a C library for Git functionality. An inverted comparison in the OpenSSL backend's certificate verification logic, specifically when handling IP-literal hosts and certificate IP SubjectAltNames, allows a network attacker to intercept HTTPS connections. By presenting a...

CVE-2026-53587

A flaw was found in libgit2. A fixed-size string comparison in the setdata function within transports/smartpkt.c does not adequately verify the size of a network packet buffer. A remote attacker, operating a malicious Git server, can send a specially crafted packet-line capability buffer. This ca...

AZL-96968 CVE-2026-53587 affecting package libgit2 1.7.2-1

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in setdata in src/libgit2/transports/smartpkt.c without first...

CVE-2026-53587

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in setdata in src/libgit2/transports/smartpkt.c without first...

CVE-2026-53586

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in HTTP transport in src/libgit2/transports/http.c follows an offsite initial redirect, an...

CVE-2026-53583

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verifyservercert in src/libgit2/streams/openssl.c uses an inverted !!memcmp result in the GENIPADD...