MGASA-2026-0570 Updated libgit2 package fixes security vulnerabilities

Inverted IP SubjectAltName Comparison in OpenSSL Backend. CVE-2026-53583 Submodule path traversal. CVE-2026-53584 Unbounded Memory Allocation via Delta Object Result-Size Header. CVE-2026-53585 HTTP transport can leak credentials to an offsite redirect target. CVE-2026-53586 Unauthenticated...

OESA-2026-4622 libgit2 security update

libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant linkable library with a solid API, allowing you to write native speed custom Git applications in any language which supports C bindings. Security Fixes: libgit2 versions before 1.8.7 and 1.9.0 before 1.9...

OESA-2026-4623 libgit2 security update

libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant linkable library with a solid API, allowing you to write native speed custom Git applications in any language which supports C bindings. Security Fixes: libgit2 versions before 1.8.7 and 1.9.0 before 1.9...

OESA-2026-4621 libgit2 security update

libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant linkable library with a solid API, allowing you to write native speed custom Git applications in any language which supports C bindings. Security Fixes: libgit2 versions before 1.8.7 and 1.9.0 before 1.9...

SUSE CVE-2026-5917

libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend USESSH=libssh2 contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacte...

ALPINE-CVE-2026-5917

libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend USESSH=libssh2 contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacte...

CVE-2026-5917

libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend USESSH=libssh2 contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacte...

CVE-2026-5917

libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 , when built with the libssh2 SSH backend, contain a shell command injection vulnerability. The gen_proto() function in ssh_libssh2.c inserts a repository path directly into a shell command string without escaping metacharacters (single quotes,...

CVE-2026-5917: Improper Neutralization of Special Elements used in an OS Command

libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend USESSH=libssh2 contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacte...