Description

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in versions 1.8.6 and 1.9.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-20T19:16:55.137Z",
  "pubdate": "2026-08-20T19:16:55.137Z",
  "executiveSummary": "A heap out-of-bounds walk vulnerability exists in the libgit2 library prior to versions 1.8.6 and 1.9.5.\nThe vulnerability arises from improper bounds checking during the processing of smart-protocol packet lines within the set_data function located in src/libgit2/transports/smart_pkt.c.\nA malicious Git server can exploit this flaw by supplying a crafted capability buffer lacking the expected 14-byte length during the initial refs-advertisement phase over HTTP, HTTPS, SSH, or the Git protocol.\nSuccessful exploitation causes the format_str pointer to advance beyond the pkt-line boundaries, leading to an integer underflow in subsequent memchr length calculations and a resulting heap out-of-bounds walk.\nThe primary impact of this vulnerability is a Denial of Service (DoS) resulting in client application crashes during normal repository cloning or fetching operations.\nNo authentication or elevated privileges are required by the attacker, provided the client connects to a malicious or compromised Git server.",
  "technicalDetails": "The vulnerability is rooted in the set_data function within src/libgit2/transports/smart_pkt.c of the libgit2 library.\nAffected versions include all releases of libgit2 prior to 1.8.6 and 1.9.5.\nThe core flaw occurs when libgit2 parses the smart-protocol pkt-line capability buffer and performs a fixed-size strncmp comparison looking for the object-format= directive.\nThe parser fails to verify beforehand that the capability buffer actually contains the minimum required 14 bytes to safely execute the comparison.\nAn adversarial Git server can manipulate the smart-protocol response during the initial refs-advertisement packet phase over transport mechanisms such as HTTP, HTTPS, SSH, or the native Git protocol.\nWhen the fixed-size strncmp executes against an undersized buffer, format_str advances past the valid boundaries of the pkt-line.\nThis out-of-bounds pointer advancement corrupts the internal state expected by subsequent memory operations, specifically causing a length calculation underflow within a memchr function call.\nThe subsequent memory operation results in an uncontrolled heap out-of-bounds walk.\nThis memory corruption immediately triggers a segmentation fault or memory access violation, crashing the client application during the initial connection handshake.\nNo pre-existing authentication or special privileges are necessary for exploitation beyond the client initiating a standard network interaction with the malicious server."
}