Hi,

libgit2-1.9.5 fixes several vulnerabilities [0]: """ Fix for blame error handling on hunk creation failures

Fix for potential PCRE memory access: 1-byte heap-buffer-overflow WRITE in bundled PCRE 8.45 reachable via revspec

🔒 This is a security release with multiple changes.

This vulnerability was identified by @DavidKorczynski.

hunkfromentry can return NULL on error; handle that and return an error.

libgit2's builtin HTTP transport follows offsite redirects for the initial smart HTTP request by default. If the redirected server then returns 401 Unauthorized, libgit2 asks the application credential callback for credentials using the original remote URL, not the redirected URL. The returned credential is then attached to the next request to the redirected host as an Authorization header.

gitrevparsesingle accepts revspecs of the form :/<pattern> (the "grep by commit message" shorthand) and forwards <pattern> directly to libgit2's regex backend. When libgit2 is using its builtin regular expression engine, this causes a heap buffer overflow.

Fix for CVE-2026-53587: libgit2 version 1.9.4 and below is vulnerable to a heap out-of-bounds read in setdata in src/libgit2/transports/smartpkt.c.

Fix for CVE-2026-53586: give auth callback current host

This vulnerability was identified by @manop55555, and CVE-2026-53587 was issued for this vulnerability.

This vulnerability was identified by @sondt99, and CVE-2026-53586 was issued for this vulnerability.

Potential denial of service because gitdeltaapply reads the claimed result size (ressz) from the delta object header — data entirely controlled by the sender — and immediately allocates a buffer of that size.

When given capabilities, we check for the object-format capability; we need to ensure that the current packet buffer is large enough before actually doing the check.

Fix for CVE-2026-53584: submodule: check paths for escaping

Fix for CVE-2026-53585: Unbounded Memory Allocation via Delta Object Result-Size Header

This vulnerability was identified by @sectroyer, and CVE-2026-53584 was issued for this vulnerability.

This vulnerability was identified by Michał Majchrowicz and Marcin Wyczechowski, members of the AFINE Team, and CVE-2026-53585 was issued for this vulnerability.

An inverted comparison in the OpenSSL TLS backend causes IP SubjectAltName (SAN) verification to accept certificates with mismatched IP addresses and reject certificates with correct IP addresses. This allows a network attacker with a valid CA-signed certificate containing any IP SAN to perform MITM attacks against libgit2 clients connecting to IP-literal HTTPS URLs.

A crafted repository with a submodule whose path contains traversal components (e.g. "../") can cause the library to create directories outside the repository's working tree.

This vulnerability was identified by @pavelkohout396, and CVE-2026-53583 was issued for this vulnerability.

Fix for CVE-2026-53583: inverted IP SubjectAltName comparison in OpenSSL backend.

All users of the v1.8 release line are recommended to upgrade.

libgit2 thanks the reporters of these issues for their responsible disclosure. """

(I'm sorry for not reformatting but if I were to impose that constraint upon myself for every such announcement, it would likely deter me from posting at least in some cases.)

Out of those, CVE-2026-53587 and CVE-2026-53584 seem the most significant.

Further, in 1.9.7 [1], there is another escape fix:

""" Escape remote repository paths in libssh2

In v1.8.5, we started escaping repository paths in the OpenSSH-based exec ssh transport. Bring the same escaping to the libssh2 transport to avoid any potential command injection.

This is a security release with one change.

In addition, changes have been ported from the main branch to update CI builds.

Thank you to @izzy0101010101 for responsibly disclosing this issue to us, and thank you to @sgallagher for the fix. This bug was identified as CVE 2026-5917 by an unrelated third party. """

I believe 1.8.6 and 1.8.7 have equivalent fixes for the 1.8.x branch.

[0] https://github.com/libgit2/libgit2/releases/tag/v1.9.5 [1] https://github.com/libgit2/libgit2/releases/tag/v1.9.7

thanks, sam

libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USESSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The genproto() function in sshlibssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2channelexec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to gitrevparsesingle can cause the function to enter an infinite loop, potentially causing a Denial of Service attack in the calling application. The revparse function in src/libgit2/revparse.c uses a loop to parse the user-provided spec string. There is an edge-case during parsing that allows a bad actor to force the loop conditions to access arbitrary memory. Potentially, this could also leak memory if the extracted rev spec is reflected back to the attacker. As such, libgit2 versions before 1.4.0 are not affected. Users should upgrade to version 1.6.5 or 1.7.2.

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to gitindexadd can cause heap corruption that could be leveraged for arbitrary code execution. There is an issue in the hasdirname function in src/libgit2/index.c, which frees an entry that should not be freed. The freed entry is later used and overwritten with potentially bad actor-controlled data leading to controlled heap corruption. Depending on the application that uses libgit2, this could lead to arbitrary code execution. This issue has been patched in version 1.6.5 and 1.7.2.

libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the certificatecheck field of libgit2's gitremotecallbacks structure - if a certificate check callback is not set, libgit2 does not perform any certificate checking. This means that by default - without configuring a certificate check callback, clients will not perform validation on the server SSH keys and may be subject to a man-in-the-middle attack. Users are encouraged to upgrade to v1.4.5 or v1.5.1. Users unable to upgrade should ensure that all relevant certificates are manually checked.

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

In ngpkt in transports/smartpkt.c in libgit2 before 0.26.6 and 0.27.x before 0.27.4, a remote attacker can send a crafted smart-protocol "ng" packet that lacks a '\0' byte to trigger an out-of-bounds read that leads to DoS.

A flaw was found in libgit2 before version 0.27.3. A missing check in gitdeltaapply function in delta.c file, may lead to an out-of-bound read while reading a binary delta file. An attacker may use this flaw to cause a Denial of Service.

A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in gitdeltaapply function in delta.c file may lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. An attacker may use this flaw to leak memory addresses or cause a Denial of Service.

Integer overflow in the index.c:readentry() function while decompressing a compressed prefix length in libgit2 before v0.26.2 allows an attacker to cause a denial of service (out-of-bounds read) via a crafted repository index file.

Incorrect returning of an error code in the index.c:readentry() function leads to a double free in libgit2 before v0.26.2, which allows an attacker to cause a denial of service via a crafted repository index file.