Loading vulnerability…
Heap out-of-bounds read in libgit2 smart-protocol capability parsing
CVE-2026-53587 is a heap out-of-bounds read in libgit2's set_data() smart-protocol packet parser, fixed in versions 1.8.6 and 1.9.5. The parser performs a fixed-size strncmp() comparison for the object-format capability without verifying that the capability buffer contains at least 14 bytes. A malicious Git server can arrange for bytes beyond the pkt-line boundary to complete the comparison, advancing format_str beyond the packet and causing the subsequent memchr() length calculation to underflow. The resulting out-of-bounds heap scan can crash the client while processing the first reference-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote, unauthenticated attacker can crash a vulnerable libgit2 client process, disrupting applications or automated workflows that access an attacker-controlled Git server. The vulnerability is rated CVSS v3.0 7.5, with high availability impact and no scored confidentiality or integrity impact. Under certain heap layouts, out-of-bounds heap contents may also be copied into an error string; remote disclosure of those contents is not established. Arbitrary code execution is not established.
If you can’t patch tonight, do this now.
No separate temporary workaround is specified. Until updates can be applied, avoid connecting libgit2-based clients to untrusted Git servers and prevent untrusted parties from controlling or intercepting Git server responses.
Patch, then assume compromise.
Upgrade libgit2 to version 1.8.6 on the 1.8 maintenance branch, version 1.9.5 on the 1.9 branch, or a later patched release. Alternatively, install the distribution's backported security update; Debian 13 provides the fix in version 1.9.0+ds-2+deb13u1. Update affected applications and Rust packages that bundle libgit2 through libgit2-sys: updating only the shared system library does not repair an application that still uses a vulnerable statically linked copy. Install vendor-provided rebuilt packages or rebuild affected applications against a patched library. The parser fix validates the available packet-buffer length before checking the object-format capability.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.