CVE-2026-53587 in libgit2
Summary
by MITRE • 08/20/2026
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in versions 1.8.6 and 1.9.5.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified as CVE-2024-37895 represents a critical heap-based buffer overflow within libgit2, a widely adopted C library that provides core Git functionality to various applications through a linkable API. This flaw resides specifically in the smart transport layer implementation found in src/libgit2/transports/smart_pkt.c during the processing of protocol packets. The root cause is an insufficient boundary check when handling pkt-line capabilities. Specifically, the function set_data performs a fixed-size strncmp operation without first verifying that the incoming capability buffer contains at least fourteen bytes. This lack of validation allows a malicious Git server to craft a response where data immediately following the complete object-format= string causes internal pointers and length calculations to behave incorrectly.
The technical mechanism of exploitation involves an integer underflow resulting from improper memory length calculation. When the client processes the first refs-advertisement packet over protocols such as HTTP, HTTPS, SSH, or the native Git protocol, it attempts to parse capability strings. Due to the missing size verification, the format_str pointer advances beyond the intended pkt-line boundary. Subsequently, a call to memchr to determine string length results in an underflow because the calculated length becomes negative or excessively large due to wrap-around behavior on unsigned integer types. This miscalculation leads to a heap out-of-bounds read operation during subsequent memory walks, which inevitably causes application crashes and potential denial of service conditions for any client relying on libgit2 for repository interactions.
From an operational impact perspective, this vulnerability allows remote attackers to trigger arbitrary code execution or cause severe stability issues by simply hosting a malicious Git server. Since the attack vector is network-based and does not require user interaction beyond initiating a clone, fetch, or pull operation against a compromised host, the risk profile is high. The flaw affects both client-side applications built with libgit2 and potentially servers if they utilize the library for local operations involving untrusted input. The ability to crash clients during standard repository synchronization tasks undermines the reliability of version control workflows in automated pipelines, continuous integration systems, and desktop Git clients that depend on this underlying library.
This vulnerability is categorized under CWE-190 Integer Overflow or Wraparound and CWE-787 Out-of-bounds Write due to the memory corruption resulting from incorrect length calculations leading to buffer overruns. In terms of adversary tactics, it aligns with MITRE ATT&CK technique T1496 Resource Hijacking if used for denial of service, though more critically it enables potential code execution vectors associated with heap exploitation techniques found in T1203 Exploitation for Client Execution. The vulnerability highlights the importance of rigorous input validation and bounds checking when parsing network protocols that involve variable-length fields or capability negotiations.
Mitigation requires immediate upgrading to libgit2 version 1.8.6 or later, where this boundary check has been corrected to ensure sufficient buffer space is verified before performing string operations. For organizations unable to upgrade immediately, implementing strict input filtering at the application layer to reject malformed pkt-line capabilities can provide a temporary defense-in-depth measure. Additionally, deploying network intrusion detection systems capable of identifying anomalous Git protocol traffic patterns may help detect exploitation attempts in real-time while patching efforts are underway. Developers integrating libgit2 should also review their error handling mechanisms to ensure that crashes resulting from such memory corruption do not expose sensitive state information or lead to further security degradation.