CVE-2026-53587

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53587", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-09T19:11:53.484Z", "datePublished": "2026-08-20T18:36:43.055Z", "dateUpdated": "2026-08-20T19:18:33.821Z"}, "containers": {"cna": {"title": "libgit2 - Unauthenticated network-reachable heap out-of-bounds read in transports/smart_pkt.c:set_data", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-126", "lang": "en", "description": "CWE-126: Buffer Over-read", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1284", "lang": "en", "description": "CWE-1284: Improper Validation of Specified Quantity in Input", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/libgit2/libgit2/security/advisories/GHSA-pm24-4jhq-3xvm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/libgit2/libgit2/security/advisories/GHSA-pm24-4jhq-3xvm"}, {"name": "https://github.com/libgit2/libgit2/commit/2c0ce8c0132ac38ab0db28239462a671e2e5440e", "tags": ["x_refsource_MISC"], "url": "https://github.com/libgit2/libgit2/commit/2c0ce8c0132ac38ab0db28239462a671e2e5440e"}, {"name": "https://github.com/libgit2/libgit2/commit/affda60c10fcef16723451c0d7dc71b71dc20ad3", "tags": ["x_refsource_MISC"], "url": "https://github.com/libgit2/libgit2/commit/affda60c10fcef16723451c0d7dc71b71dc20ad3"}, {"name": "https://github.com/libgit2/libgit2/commit/d7a9fb87f504434e9f45228678953c4fa56e7640", "tags": ["x_refsource_MISC"], "url": "https://github.com/libgit2/libgit2/commit/d7a9fb87f504434e9f45228678953c4fa56e7640"}, {"name": "https://github.com/libgit2/libgit2/releases/tag/v1.8.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/libgit2/libgit2/releases/tag/v1.8.6"}, {"name": "https://github.com/libgit2/libgit2/releases/tag/v1.9.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/libgit2/libgit2/releases/tag/v1.9.5"}], "affected": [{"vendor": "libgit2", "product": "libgit2", "versions": [{"version": "< 1.8.6", "status": "affected"}, {"version": ">= 1.9.0, < 1.9.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T18:36:43.055Z"}, "descriptions": [{"lang": "en", "value": "libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in versions 1.8.6 and 1.9.5."}], "source": {"advisory": "GHSA-pm24-4jhq-3xvm", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/libgit2/libgit2/security/advisories/GHSA-pm24-4jhq-3xvm", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-20T19:18:28.320266Z", "id": "CVE-2026-53587", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T19:18:33.821Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-53587", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T19:18:28.320266Z"}}}], "references": [{"url": "https://github.com/libgit2/libgit2/security/advisories/GHSA-pm24-4jhq-3xvm", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T19:18:12.597Z"}}], "cna": {"title": "libgit2 - Unauthenticated network-reachable heap out-of-bounds read in transports/smart_pkt.c:set_data", "source": {"advisory": "GHSA-pm24-4jhq-3xvm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "libgit2", "product": "libgit2", "versions": [{"status": "affected", "version": "< 1.8.6"}, {"status": "affected", "version": ">= 1.9.0, < 1.9.5"}]}], "references": [{"url": "https://github.com/libgit2/libgit2/security/advisories/GHSA-pm24-4jhq-3xvm", "name": "https://github.com/libgit2/libgit2/security/advisories/GHSA-pm24-4jhq-3xvm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/libgit2/libgit2/commit/2c0ce8c0132ac38ab0db28239462a671e2e5440e", "name": "https://github.com/libgit2/libgit2/commit/2c0ce8c0132ac38ab0db28239462a671e2e5440e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libgit2/libgit2/commit/affda60c10fcef16723451c0d7dc71b71dc20ad3", "name": "https://github.com/libgit2/libgit2/commit/affda60c10fcef16723451c0d7dc71b71dc20ad3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libgit2/libgit2/commit/d7a9fb87f504434e9f45228678953c4fa56e7640", "name": "https://github.com/libgit2/libgit2/commit/d7a9fb87f504434e9f45228678953c4fa56e7640", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libgit2/libgit2/releases/tag/v1.8.6", "name": "https://github.com/libgit2/libgit2/releases/tag/v1.8.6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libgit2/libgit2/releases/tag/v1.9.5", "name": "https://github.com/libgit2/libgit2/releases/tag/v1.9.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in versions 1.8.6 and 1.9.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-126", "description": "CWE-126: Buffer Over-read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1284", "description": "CWE-1284: Improper Validation of Specified Quantity in Input"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T18:36:43.055Z"}}}, "cveMetadata": {"cveId": "CVE-2026-53587", "state": "PUBLISHED", "dateUpdated": "2026-08-20T19:18:33.821Z", "dateReserved": "2026-06-09T19:11:53.484Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-20T18:36:43.055Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "libgit2", "vendor": "libgit2", "versions": [{"status": "affected", "version": "< 1.8.6"}, {"status": "affected", "version": ">= 1.9.0, < 1.9.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in versions 1.8.6 and 1.9.5."}, {"lang": "es", "value": "libgit2 es una implementaci\u00f3n port\u00e1til en C de los m\u00e9todos centrales de Git proporcionada como una biblioteca enlazable con una API s\u00f3lida, que permite integrar la funcionalidad de Git en su aplicaci\u00f3n. Antes de las versiones 1.8.6 y 1.9.5, libgit2 realiza un strncmp de tama\u00f1o fijo en set_data en src/libgit2/transports/smart_pkt.c sin verificar primero que el b\u00fafer de capacidad pkt-line del protocolo inteligente contenga 14 bytes. Un servidor Git malicioso puede hacer que los bytes despu\u00e9s de la pkt-line completen object-format=, haciendo que format_str avance m\u00e1s all\u00e1 de la pkt-line y que el c\u00e1lculo de longitud de memchr subsiguiente sufra un desbordamiento negativo. El recorrido resultante de la memoria din\u00e1mica (heap) fuera de l\u00edmites puede bloquear a un cliente durante el primer paquete de anuncio de referencias a trav\u00e9s de HTTP, HTTPS, SSH o el protocolo Git. Este problema est\u00e1 solucionado en las versiones 1.8.6 y 1.9.5."}], "id": "CVE-2026-53587", "lastModified": "2026-10-26T10:10:00.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53587", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-20T19:18:28.320266Z", "version": "2.0.3"}}]}, "published": "2026-08-20T19:16:55.137", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/libgit2/libgit2/commit/2c0ce8c0132ac38ab0db28239462a671e2e5440e"}, {"source": "security-advisories@github.com", "url": "https://github.com/libgit2/libgit2/commit/affda60c10fcef16723451c0d7dc71b71dc20ad3"}, {"source": "security-advisories@github.com", "url": "https://github.com/libgit2/libgit2/commit/d7a9fb87f504434e9f45228678953c4fa56e7640"}, {"source": "security-advisories@github.com", "url": "https://github.com/libgit2/libgit2/releases/tag/v1.8.6"}, {"source": "security-advisories@github.com", "url": "https://github.com/libgit2/libgit2/releases/tag/v1.9.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/libgit2/libgit2/security/advisories/GHSA-pm24-4jhq-3xvm"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/libgit2/libgit2/security/advisories/GHSA-pm24-4jhq-3xvm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-126"}, {"lang": "en", "value": "CWE-1284"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "libgit2: libgit2: Denial of Service due to heap out-of-bounds read from malicious Git server", "id": "2520693", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520693"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in versions 1.8.6 and 1.9.5.", "A flaw was found in libgit2. A fixed-size string comparison in the `set_data` function within `transports/smart_pkt.c` does not adequately verify the size of a network packet buffer. A remote attacker, operating a malicious Git server, can send a specially crafted packet-line capability buffer. This can lead to a heap out-of-bounds read, causing the client application to crash and resulting in a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-53587", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "libgit2", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "libgit2", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "rust", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "libgit2", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-08-20T18:36:43Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-53587\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53587\nhttps://github.com/libgit2/libgit2/commit/2c0ce8c0132ac38ab0db28239462a671e2e5440e\nhttps://github.com/libgit2/libgit2/commit/affda60c10fcef16723451c0d7dc71b71dc20ad3\nhttps://github.com/libgit2/libgit2/commit/d7a9fb87f504434e9f45228678953c4fa56e7640\nhttps://github.com/libgit2/libgit2/releases/tag/v1.8.6\nhttps://github.com/libgit2/libgit2/releases/tag/v1.9.5\nhttps://github.com/libgit2/libgit2/security/advisories/GHSA-pm24-4jhq-3xvm"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.8.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.9.0,1.9.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "libgit2", "source": "cna", "vendor": "libgit2"}, "product": "libgit2", "vendor": "libgit2"}], "created": "2026-08-20T20:30:05.364441+00:00", "updated": "2026-08-21T01:45:08.036683+00:00", "vendors": ["libgit2", "libgit2$PRODUCT$libgit2"]}