Описание
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in versions 1.8.6 and 1.9.5.
A flaw was found in libgit2. A fixed-size string comparison in the set_data function within transports/smart_pkt.c does not adequately verify the size of a network packet buffer. A remote attacker, operating a malicious Git server, can send a specially crafted packet-line capability buffer. This can lead to a heap out-of-bounds read, causing the client application to crash and resulting in a Denial of Service (DoS).
Отчет
This flaw is rated with an Important impact for Red Hat products because an unauthenticated remote server can trigger an out-of-bounds memory read that terminates client applications utilizing libgit2 without requiring user interaction beyond initiating a network connection. In typical deployments, the vulnerability is exposed whenever developer utilities, build pipelines, or containerized services perform fetch or clone operations against an untrusted upstream Git repository. Because the issue is confined to abnormal client termination during initial handshake negotiations, it results in a denial of service without compromising host integrity or disclosing sensitive system data.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 8 | libgit2 | Affected | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | libgit2 | Affected | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rust | Affected | ||
| Red Hat Enterprise Linux 10 | rust | Fixed | RHSA-2026:67286 | 14.09.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | rust | Fixed | RHSA-2026:69096 | 21.09.2026 |
| Red Hat Enterprise Linux 9 | rust | Fixed | RHSA-2026:67285 | 14.09.2026 |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | rust | Fixed | RHSA-2026:69097 | 21.09.2026 |
| Red Hat Enterprise Linux 9.6 Extended Update Support | rust | Fixed | RHSA-2026:69109 | 21.09.2026 |
| Red Hat Hardened Images | libgit2-main-1.9.7-1.hum1 | Fixed | RHSA-2026:59361 | 25.08.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
7.5 High
CVSS3
Связанные уязвимости
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in versions 1.8.6 and 1.9.5.
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in versions 1.8.6 and 1.9.5.
libgit2 is a portable C implementation of the Git core methods provide ...
7.5 High
CVSS3