https://seclists.org/oss-sec/2026/q3/525: Multiple vulnerabilities fixed in libgit2-1.9.5, 1.9.7

Q: When can the regular-expression memory corruption be reached?

It is reachable when git_revparse_single processes a revspec using the :/<pattern> commit-message search shorthand and libgit2 is using its built-in regular-expression engine. The pattern is passed directly to that backend, causing a heap buffer overflow.

Published Aug 20, 2026

Updated

Affected Software

3 affected components

libgit2 libgit2>=1.9.0<1.9.5

libgit2 libgit2>=1.8.0<=1.8.4

libgit2 libgit2>=1.8.5<1.8.6

Frequently Asked Questions

When can the regular-expression memory corruption be reached?

It is reachable when git_revparse_single processes a revspec using the :/<pattern> commit-message search shorthand and libgit2 is using its built-in regular-expression engine. The pattern is passed directly to that backend, causing a heap buffer overflow.

Can the HTTP credential issue occur with default redirect behavior?

Yes. libgit2's built-in HTTP transport follows offsite redirects for the initial smart HTTP request by default. If the redirected host replies with 401 Unauthorized, credentials obtained for the original remote URL can be sent to the redirected host in an Authorization header.

Which versions are identified as vulnerable to CVE-2026-53587?

The advisory states that libgit2 1.9.4 and earlier are vulnerable to a heap out-of-bounds read in set_data in the transport code.