CVE-2016-10130: Medium severity Libgit2 Project Libgit2 vulnerability
Last updated 13 August 2026
Other sources
The httpconnect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/cargoto a version that resolves this vulnerability.Fixed in 0.47.0-3Fixed in 0.66.0+ds1-1 - Upgrade
Upgrade
debian/libgit2to a version that resolves this vulnerability.Fixed in 1.1.0+dfsg.1-4+deb11u2Fixed in 1.5.1+ds-1+deb12u1Fixed in 1.9.0+ds-2Fixed in 1.9.6+ds-1 - Upgrade
Upgrade
libgit2to a version that resolves this vulnerability.Fixed in 0.24.6 - Upgrade
Upgrade
libgit2to a version that resolves this vulnerability.Fixed in 0.25.1
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10130?
CVE-2016-10130 is classified as a medium-severity vulnerability due to the potential for man-in-the-middle attacks.
How do I fix CVE-2016-10130?
To fix CVE-2016-10130, update libgit2 to version 0.24.6 or 0.25.1 or later.
Which versions of libgit2 are affected by CVE-2016-10130?
Libgit2 versions before 0.24.6 and 0.25.0 are affected by CVE-2016-10130.
What type of attack does CVE-2016-10130 enable?
CVE-2016-10130 enables man-in-the-middle attacks, allowing attackers to spoof servers.
What function in libgit2 is associated with CVE-2016-10130?
The vulnerability in CVE-2016-10130 is associated with the http_connect function in transports/http.c.