Loading story…
libgit2 released security fixes in versions 1.9.5 and 1.9.7 to address multiple vulnerabilities affecting HTTP authentication, smart packet parsing, submodule handling, TLS certificate validation, regex processing, delta handling, and SSH transport escaping. The most serious issues include CVE-2026-53587, a heap out-of-bounds read in smart_pkt.c triggered by malformed capability data, and CVE-2026-53584, a submodule path traversal flaw that could create directories outside a repository working tree. Other patched issues include CVE-2026-53586 for credential leakage across redirected HTTP hosts, CVE-2026-53585 for unbounded memory allocation that can cause denial of service, and CVE-2026-53583 for incorrect IP SubjectAltName verification in the OpenSSL backend that could enable man-in-the-middle attacks.
Project commits show the packet-parsing fix added explicit length checks before comparing the object-format= capability, preventing strncmp from reading past truncated packet data; equivalent patches were applied on the main, v1.9.7, and v1.8 maintenance lines. The 1.9.5 release also fixed a heap buffer overflow in bundled PCRE reachable through revspec parsing and an error-handling flaw in blame hunk creation, while 1.9.7 additionally addressed CVE-2026-5917, a libssh2 transport escaping issue that could lead to command injection. Users on the v1.8 branch were advised to move to 1.8.6 or 1.8.7, which are believed to contain corresponding fixes.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
On July 18, 2026, libgit2 committed the smart packet parsing bounds-check fix to the main branch in commit d7a9fb8. The patch prevents reading past available packet data when checking for the object-format capability in set_data.
On July 18, 2026, libgit2 released version 1.9.5 as a security update fixing multiple vulnerabilities, including CVE-2026-53583, CVE-2026-53584, CVE-2026-53585, CVE-2026-53586, and CVE-2026-53587, plus a bundled PCRE issue. The release notes advised users to upgrade to the patched release.
On June 6, 2026, libgit2 committed the same smart packet parsing bounds check to the maint/v1.9 branch, adding a length guard before comparing the object-format capability string in src/libgit2/transports/smart_pkt.c. The fix is associated with the v1.9.7 maintenance line.
On June 6, 2026, libgit2 committed a bounds-checking fix on the maint/v1.8 branch to ensure packet data is long enough before checking the object-format capability in smart packet parsing. This change addresses the unsafe parsing condition later described as CVE-2026-53587 and is associated with v1.8.6/v1.8.7.
An oss-sec post reported that libgit2 versions 1.9.5 and 1.9.7 fix multiple security vulnerabilities across HTTP authentication, regex parsing, packet parsing, submodule path handling, TLS certificate validation, delta processing, and SSH path escaping. It highlighted CVE-2026-53587 and CVE-2026-53584 as especially significant and advised users of the v1.8 line to upgrade.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A **shell command injection** vulnerability tracked as `CVE-2026-5917` affects **libgit2** versions `0.27.0` through `1.9.0` when the library is built with the **libssh2** SSH backend using `USE_SSH=libssh2`. The flaw is in the `gen_proto()` function in `ssh_libssh2.c`, which inserts a repository path into a shell command without escaping shell metacharacters before passing it to `libssh2_channel_exec()`. The issue is classified as `CWE-78` and carries a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H`. Attackers can exploit the bug by supplying a malicious repository path containing characters such as quotes, semicolons, or pipes, including through a crafted submodule URL in a `.gitmodules` file during a **recursive clone**. If triggered, the SSH server's shell may execute attacker-injected commands under the victim's SSH user account, creating a path to full compromise of confidentiality, integrity, and availability in affected environments.
Aug 13, 2026
Libssh released versions **0.12.1** and **0.11.5** to fix multiple security issues, including **CVE-2026-59851**, an authentication bypass in deployments where `GSSAPIKeyExchange` is enabled on servers. The flaw allows an authenticated client to log in as an arbitrary local user because the `gssapi-keyex` path fails to verify whether the authenticated Kerberos principal is authorized for the requested account. The vulnerability is tracked as **CWE-863** and carries a **CVSS v3.1** score reflecting high impact to confidentiality, integrity, and availability. The **0.12.1** release addresses **11 CVEs**, while **0.11.5** backports fixes for **8 CVEs** affecting the 0.11 branch. In addition to the authentication bypass, the updates remediate a stack buffer overflow, information disclosure bugs, several denial-of-service conditions, a use-after-free issue, and an integrity downgrade flaw, alongside hardening changes such as zero-initializing `ssh_string` objects and validating peer public keys during Diffie-Hellman key exchange. Red Hat reported **RHEL 8** and **RHEL 9** as unaffected by `CVE-2026-59851`, listed **RHEL 10** status as unknown, and marked **Red Hat Hardened Images** as affected for `libssh` and `libssh2` package entries.
Jul 21, 2026
GitLab released security updates for Community Edition and Enterprise Edition, shipping versions **18.10.3**, **18.9.5**, and **18.8.9** to address multiple vulnerabilities tracked as `CVE-2026-5173`, `CVE-2026-1092`, `CVE-2025-12664`, and `CVE-2026-1101`. The patched issues include a high-severity flaw that could allow unintended server-side method invocation over WebSocket connections, along with several denial-of-service weaknesses affecting the Terraform state lock API and the GraphQL API. The release also fixes medium- and low-severity bugs including cross-site scripting in analytics dashboards, code-injection-related IP leakage in Code Quality reports, authorization weaknesses in APIs and custom roles, and information disclosure through GraphQL queries and CSV export. GitLab said **GitLab.com** had already been patched, **GitLab Dedicated** customers did not need to take action, and self-managed customers should upgrade immediately; the company added that the updates require no new migrations and should not cause downtime in multi-node deployments.
Jul 24, 2026