libgit2 fixes multiple flaws including path traversal, MITM, and packet parsing bugs

libgit2 released security fixes in versions 1.9.5 and 1.9.7 to address multiple vulnerabilities affecting HTTP authentication, smart packet parsing, submodule handling, TLS certificate validation, regex processing, delta handling, and SSH transport escaping. The most serious issues include CVE-2026-53587, a heap out-of-bounds read in smart_pkt.c triggered by malformed capability data, and CVE-2026-53584, a submodule path traversal flaw that could create directories outside a repository working tree. Other patched issues include CVE-2026-53586 for credential leakage across redirected HTTP hosts, CVE-2026-53585 for unbounded memory allocation that can cause denial of service, and CVE-2026-53583 for incorrect IP SubjectAltName verification in the OpenSSL backend that could enable man-in-the-middle attacks.

Project commits show the packet-parsing fix added explicit length checks before comparing the object-format= capability, preventing strncmp from reading past truncated packet data; equivalent patches were applied on the main, v1.9.7, and v1.8 maintenance lines. The 1.9.5 release also fixed a heap buffer overflow in bundled PCRE reachable through revspec parsing and an error-handling flaw in blame hunk creation, while 1.9.7 additionally addressed CVE-2026-5917, a libssh2 transport escaping issue that could lead to command injection. Users on the v1.8 branch were advised to move to 1.8.6 or 1.8.7, which are believed to contain corresponding fixes.