libgit2 v1.9.5 Security Update: Fixes for Heap Overflow, Path Traversal and More

Vulnerability Overview libgit2 v1.9.5 is a security update release containing multiple vulnerability fixes. The primary vulnerabilities include: 1. PCRE Memory Access Vulnerability: A 1-byte heap out-of-bounds write accessible via revspec in the bundled PCRE 8.45. 2. CVE-2026-53586: Issue with the current host in authentication callbacks. 3. CVE-2026-53587: Heap out-of-bounds read in the function in libgit2 versions 1.9.4 and earlier. 4. CVE-2026-53585: Uncontrolled memory allocation due to Delta object result size headers. 5. CVE-2026-53584: Submodule path traversal component leading to directory creation issues. 6. CVE-2026-53583: IP SubjectAltName comparison issue in the OpenSSL backend. Affected Scope PCRE Memory Access Vulnerability: Affects applications using the function. CVE-2026-53586: Affects applications using libgit2 HTTP transport. CVE-2026-53587: Affects libgit2 versions 1.9.4 and earlier. CVE-2026-53585: Affects applications processing Delta objects. CVE-2026-53584: Affects applications using submodules. CVE-2026-53583: Affects applications using the OpenSSL TLS backend. Remediation PCRE Memory Access Vulnerability: Fixes the heap out-of-bounds write issue in the function. CVE-2026-53586: Fixes the current host issue in authentication callbacks. CVE-2026-53587: Fixes the heap out-of-bounds read issue in the function. CVE-2026-53585: Fixes the uncontrolled memory allocation issue. CVE-2026-53584: Fixes the submodule path traversal component issue. CVE-2026-53583: Fixes the IP SubjectAltName comparison issue in the OpenSSL backend. Proof of Concept (POC) Code No specific POC code or exploit code is provided in the page. Summary libgit2 v1.9.5 is a significant security update that addresses multiple critical vulnerabilities. It is recommended that all users upgrade to this version to ensure security.

Goal Reached Thanks to every supporter — we hit 100%!

libgit2 v1.9.5 Security Update: Fixes for Heap Overflow, Path Traversal and More

More from this source