Heap Out-of-Bounds Vulnerability in Libgit2 by libgit2
CVE-2026-53587
7.5HIGH
What is CVE-2026-53587?
libgit2, a portable C implementation of Git core methods, contains a vulnerability where it performs a fixed-size strncmp in set_data without verifying the smart-protocol pkt-line capability buffer's size. This flaw can allow a malicious Git server to manipulate the data, leading to a heap out-of-bounds write that may crash clients during their interaction with the Git server via various protocols such as HTTP, HTTPS, SSH, or the Git protocol. To mitigate this issue, users should upgrade to libgit2 versions 1.8.6 or later, or 1.9.5 or later.
Affected Version(s)
libgit2 < 1.8.6 < 1.8.6
libgit2 >= 1.9.0, < 1.9.5 < 1.9.0, 1.9.5