libgit2 v1.8.6 Security Advisory: Multiple CVE Fixes (Heap Overflow, SSRF, Path Traversal)

Vulnerability Overview libgit2 v1.8.6 is a security update release containing multiple vulnerability fixes. The primary vulnerabilities include: 1. PCRE Memory Access Vulnerability: A heap overflow can be triggered via the function in the bundled PCRE 8.45. 2. CVE-2026-53586: When handling redirects, the libgit2 HTTP transport module may incorrectly append credentials to the wrong URL. 3. CVE-2026-53587: A heap-based buffer over-read vulnerability exists in libgit2 versions 1.9.4 and earlier. 4. CVE-2026-53585: Unbounded memory allocation for the header of the delta object result size. 5. CVE-2026-53584: Submodule path traversal vulnerability. 6. CVE-2026-53583: Incorrect comparison of IP Subject Alternative Names in the OpenSSL backend. Impact Scope PCRE Memory Access Vulnerability: Affects applications that utilize the function. CVE-2026-53586: Affects applications using the libgit2 HTTP transport module. CVE-2026-53587: Affects applications using libgit2 versions 1.9.4 and earlier. CVE-2026-53585: Affects applications processing delta objects. CVE-2026-53584: Affects applications using submodules. CVE-2026-53583: Affects applications utilizing the OpenSSL backend. Remediation PCRE Memory Access Vulnerability: Fixes the heap overflow issue within the function. CVE-2026-53586: Ensures that credentials are correctly attached to the original URL during redirects. CVE-2026-53587: Adds checks for the current packet buffer to ensure it is sufficiently large. CVE-2026-53585: Restricts memory allocation for the delta object result size header. CVE-2026-53584: Prevents submodule path traversal. CVE-2026-53583: Corrects the IP Subject Alternative Name comparison logic in the OpenSSL backend. Proof of Concept (POC) No specific POC code or exploit code is provided in this document. Summary libgit2 v1.8.6 is a critical security update that addresses multiple significant vulnerabilities. All users are advised to upgrade to this version to ensure security.

Goal Reached Thanks to every supporter — we hit 100%!

libgit2 v1.8.6 Security Advisory: Multiple CVE Fixes (Heap Overflow, SSRF, Path Traversal)

More from this source