CVE-2026-53587 libgit2 - Unauthenticated network-reachable heap out-of-bounds read in transports/smart_pkt.c:set_data
A malicious Git server can trigger a heap out-of-bounds read in libgit2, causing a client crash during protocol negotiation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53587?
CVE-2026-53587 is a high-severity memory corruption vulnerability in libgit2, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in versions 1.8.6 and 1.9.5.
Which versions are affected by CVE-2026-53587?
Linux distribution packages (40)
cargo AlmaLinux:10 | All versions | 1.92.0-2.el10_2.alma.1 |
clippy AlmaLinux:10 | All versions | 1.92.0-2.el10_2.alma.1 |
rust AlmaLinux:10 | All versions | 1.92.0-2.el10_2.alma.1 |
rust-analyzer AlmaLinux:10 | All versions | 1.92.0-2.el10_2.alma.1 |
rust-debugger-common AlmaLinux:10 | All versions | 1.92.0-2.el10_2.alma.1 |
rust-doc AlmaLinux:10 | All versions | 1.92.0-2.el10_2.alma.1 |
rust-gdb AlmaLinux:10 | All versions | 1.92.0-2.el10_2.alma.1 |
rust-lldb AlmaLinux:10 | All versions | 1.92.0-2.el10_2.alma.1 |
rust-src AlmaLinux:10 | All versions | 1.92.0-2.el10_2.alma.1 |
rust-std-static AlmaLinux:10 | All versions | 1.92.0-2.el10_2.alma.1 |
rust-std-static-aarch64-unknown-none-softfloat AlmaLinux:10 | All versions | 1.92.0-2.el10_2.alma.1 |
rust-std-static-wasm32-unknown-unknown AlmaLinux:10 | All versions | 1.92.0-2.el10_2.alma.1 |
rust-std-static-wasm32-wasip1 AlmaLinux:10 | All versions | 1.92.0-2.el10_2.alma.1 |
rust-std-static-x86_64-unknown-none AlmaLinux:10 | All versions | 1.92.0-2.el10_2.alma.1 |
rust-toolset AlmaLinux:10 | All versions | 1.92.0-2.el10_2.alma.1 |
rust-toolset-srpm-macros AlmaLinux:10 | All versions | 1.92.0-2.el10_2.alma.1 |
rustfmt AlmaLinux:10 | All versions | 1.92.0-2.el10_2.alma.1 |
cargo AlmaLinux:9 | All versions | 1.92.0-2.el9_8 |
clippy AlmaLinux:9 | All versions | 1.92.0-2.el9_8 |
rust AlmaLinux:9 | All versions | 1.92.0-2.el9_8 |
rust-analyzer AlmaLinux:9 | All versions | 1.92.0-2.el9_8 |
rust-debugger-common AlmaLinux:9 | All versions | 1.92.0-2.el9_8 |
rust-doc AlmaLinux:9 | All versions | 1.92.0-2.el9_8 |
rust-gdb AlmaLinux:9 | All versions | 1.92.0-2.el9_8 |
rust-lldb AlmaLinux:9 | All versions | 1.92.0-2.el9_8 |
rust-src AlmaLinux:9 | All versions | 1.92.0-2.el9_8 |
rust-std-static AlmaLinux:9 | All versions | 1.92.0-2.el9_8 |
rust-std-static-wasm32-unknown-unknown AlmaLinux:9 | All versions | 1.92.0-2.el9_8 |
rust-std-static-wasm32-wasip1 AlmaLinux:9 | All versions | 1.92.0-2.el9_8 |
rust-toolset AlmaLinux:9 | All versions | 1.92.0-2.el9_8 |
rustfmt AlmaLinux:9 | All versions | 1.92.0-2.el9_8 |
cargo Red Hat:enterprise_linux:10.2 | All versions | 0:1.92.0-2.el10_2 |
cargo-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:1.92.0-2.el10_2 |
clippy Red Hat:enterprise_linux:10.2 | All versions | 0:1.92.0-2.el10_2 |
clippy-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:1.92.0-2.el10_2 |
rust Red Hat:enterprise_linux:10.2 | All versions | 0:1.92.0-2.el10_2 |
rust-analyzer Red Hat:enterprise_linux:10.2 | All versions | 0:1.92.0-2.el10_2 |
rust-analyzer-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:1.92.0-2.el10_2 |
rust-debugger-common Red Hat:enterprise_linux:10.2 | All versions | 0:1.92.0-2.el10_2 |
rust-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:1.92.0-2.el10_2 |
How do I fix CVE-2026-53587?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-53587 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53587 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as ALSA-2026:67285, ALSA-2026:67286, AZL-96968, BELL-CVE-2026-53587, CLSA-2026-1790157025, DEBIAN-CVE-2026-53587 and 11 more.