CVE-2026-53587
Received Received - Intake

Heap Out-of-Bounds Read in libgit2 Smart Protocol

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in versions 1.8.6 and 1.9.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-53587
EUVD
EUVD-2026-63547

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
libgit2 libgit2 to 1.8.6 (inc)
libgit2 libgit2 to 1.9.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
CWE-1284 The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-126 The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in libgit2, a library for Git functionality. It involves a fixed-size string comparison without checking buffer size first. A malicious Git server can exploit this to cause a heap out-of-bounds read during the first refs-advertisement packet over HTTP, HTTPS, SSH, or Git protocol, potentially crashing the client.

Detection Guidance

To detect this vulnerability, check the version of libgit2 installed on your system. Compare it against versions 1.8.6 and 1.9.5. If your version is older, the system is vulnerable. Use commands like 'git2 --version' or check package managers such as 'apt list --installed | grep libgit2' or 'rpm -qa | grep libgit2'.

Impact Analysis

If you use a vulnerable version of libgit2, a malicious Git server could crash your client application during normal Git operations. This could disrupt workflows, cause data loss, or enable further attacks depending on the application's context.

Compliance Impact

This vulnerability primarily impacts software security and reliability rather than direct compliance with standards like GDPR or HIPAA. It could indirectly affect compliance if exploited to cause denial-of-service or unauthorized data access in systems handling sensitive data. The vulnerability allows remote code execution or crashes in applications using vulnerable libgit2 versions, potentially compromising data integrity or availability.

Mitigation Strategies

Immediately update libgit2 to version 1.8.6 or 1.9.5 or later. If updating is not possible, restrict network access to Git servers or disable Git protocol usage until patched. Monitor for unusual client crashes during Git operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53587. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart