GitHub

libgit2 v1.9.7

v1.9.7

This is a security release with one change.

  • Escape remote repository paths in libssh2

    In v1.8.5, we started escaping repository paths in the OpenSSH-based exec ssh transport. Bring the same escaping to the libssh2 transport to avoid any potential command injection.

In addition, changes have been ported from the main branch to update CI builds.

Thank you to @izzy0101010101 for responsibly disclosing this issue to us, and thank you to @sgallagher for the fix. This bug was identified as CVE 2026-5917 by an unrelated third party.

Full Changelog: v1.9.6...v1.9.7

libgit2 v1.8.7

v1.8.7

This is a security release with one change.

  • Escape remote repository paths in libssh2

    In v1.8.5, we started escaping repository paths in the OpenSSH-based exec ssh transport. Bring the same escaping to the libssh2 transport to avoid any potential command injection.

In addition, changes have been ported from the main branch to update CI builds.

Thank you to @izzy0101010101 for responsibly disclosing this issue to us, and thank you to @sgallagher for the fix. This bug was identified as CVE 2026-5917 by an unrelated third party.

Full Changelog: v1.8.6...v1.8.7

libgit2 v1.9.6

libgit2 v1.9.5

v1.9.5

πŸ”’ This is a security release with multiple changes.

  • Fix for blame error handling on hunk creation failures

    hunk_from_entry can return NULL on error; handle that and
    return an error.

  • Fix for potential PCRE memory access: 1-byte heap-buffer-overflow WRITE in bundled PCRE 8.45 reachable via revspec

    git_revparse_single accepts revspecs of the form :/<pattern> (the "grep by commit message" shorthand) and forwards <pattern> directly to libgit2's regex backend. When libgit2 is using its builtin regular expression engine, this causes a heap buffer overflow.

    This vulnerability was identified by @DavidKorczynski.

  • Fix for CVE-2026-53586: give auth callback current host

    libgit2's builtin HTTP transport follows offsite redirects for the initial smart HTTP request by default. If the redirected server then
    returns 401 Unauthorized, libgit2 asks the application credential callback for credentials using the original remote URL, not the redirected URL. The returned credential is then attached to the next request to the redirected host as an Authorization header.

    This vulnerability was identified by @sondt99, and CVE-2026-53586 was issued for this vulnerability.

  • Fix for CVE-2026-53587: libgit2 version 1.9.4 and below is vulnerable to a heap out-of-bounds read in set_data in src/libgit2/transports/smart_pkt.c.

    When given capabilities, we check for the object-format capability; we need to ensure that the current packet buffer is large enough before actually doing the check.

    This vulnerability was identified by @manop55555, and CVE-2026-53587 was issued for this vulnerability.

  • Fix for CVE-2026-53585: Unbounded Memory Allocation via Delta Object Result-Size Header

    Potential denial of service because git_delta_apply reads the claimed result size (res_sz) from the delta object header β€” data entirely controlled by the sender β€” and immediately allocates a buffer of that size.

    This vulnerability was identified by MichaΕ‚ Majchrowicz and Marcin Wyczechowski, members of the AFINE Team, and CVE-2026-53585 was issued for this vulnerability.

  • Fix for CVE-2026-53584: submodule: check paths for escaping

    A crafted repository with a submodule whose path contains traversal components (e.g. "../") can cause the library to create directories outside the repository's working tree.

    This vulnerability was identified by @sectroyer, and CVE-2026-53584 was issued for this vulnerability.

  • Fix for CVE-2026-53583: inverted IP SubjectAltName comparison in OpenSSL backend.

    An inverted comparison in the OpenSSL TLS backend causes IP SubjectAltName (SAN) verification to accept certificates with mismatched IP addresses and reject certificates with correct IP addresses. This allows a network attacker with a valid CA-signed certificate containing any IP SAN to perform MITM attacks against libgit2 clients connecting to IP-literal HTTPS URLs.

    This vulnerability was identified by @pavelkohout396, and CVE-2026-53583 was issued for this vulnerability.

All users of the v1.8 release line are recommended to upgrade.

libgit2 thanks the reporters of these issues for their responsible disclosure.

Full Changelog: v1.8.4...v1.9.5

libgit2 v1.8.6

v1.8.6

πŸ”’ This is a security release with multiple changes.

  • Fix for blame error handling on hunk creation failures

    hunk_from_entry can return NULL on error; handle that and
    return an error.

  • Fix for potential PCRE memory access: 1-byte heap-buffer-overflow WRITE in bundled PCRE 8.45 reachable via revspec

    git_revparse_single accepts revspecs of the form :/<pattern> (the "grep by commit message" shorthand) and forwards <pattern> directly to libgit2's regex backend. When libgit2 is using its builtin regular expression engine, this causes a heap buffer overflow.

    This vulnerability was identified by @DavidKorczynski.

  • Fix for CVE-2026-53586: give auth callback current host

    libgit2's builtin HTTP transport follows offsite redirects for the initial smart HTTP request by default. If the redirected server then
    returns 401 Unauthorized, libgit2 asks the application credential callback for credentials using the original remote URL, not the redirected URL. The returned credential is then attached to the next request to the redirected host as an Authorization header.

    This vulnerability was identified by @sondt99, and CVE-2026-53586 was issued for this vulnerability.

  • Fix for CVE-2026-53587: libgit2 version 1.9.4 and below is vulnerable to a heap out-of-bounds read in set_data in src/libgit2/transports/smart_pkt.c.

    When given capabilities, we check for the object-format capability; we need to ensure that the current packet buffer is large enough before actually doing the check.

    This vulnerability was identified by @manop55555, and CVE-2026-53587 was issued for this vulnerability.

  • Fix for CVE-2026-53585: Unbounded Memory Allocation via Delta Object Result-Size Header

    Potential denial of service because git_delta_apply reads the claimed result size (res_sz) from the delta object header β€” data entirely controlled by the sender β€” and immediately allocates a buffer of that size.

    This vulnerability was identified by MichaΕ‚ Majchrowicz and Marcin Wyczechowski, members of the AFINE Team, and CVE-2026-53585 was issued for this vulnerability.

  • Fix for CVE-2026-53584: submodule: check paths for escaping

    A crafted repository with a submodule whose path contains traversal components (e.g. "../") can cause the library to create directories outside the repository's working tree.

    This vulnerability was identified by @sectroyer, and CVE-2026-53584 was issued for this vulnerability.

  • Fix for CVE-2026-53583: inverted IP SubjectAltName comparison in OpenSSL backend.

    An inverted comparison in the OpenSSL TLS backend causes IP SubjectAltName (SAN) verification to accept certificates with mismatched IP addresses and reject certificates with correct IP addresses. This allows a network attacker with a valid CA-signed certificate containing any IP SAN to perform MITM attacks against libgit2 clients connecting to IP-literal HTTPS URLs.

    This vulnerability was identified by @pavelkohout396, and CVE-2026-53583 was issued for this vulnerability.

All users of the v1.8 release line are recommended to upgrade.

libgit2 thanks the reporters of these issues for their responsible disclosure.

Full Changelog: v1.8.5...v1.8.6

libgit2 v1.9.4

This release includes a few small but important bugfixes.

  • cmake: separate generated headers from translated headers by @ethomson in #7263
  • Avoid uninitialized variable warnings in gcc by @ethomson in #7258
  • fix: Recognize relative worktrees extension by @cwill747 in #7254
  • fix(sha256): thread-safety bug in builtin SHA-256 by @weihanglo in #7266

libgit2 v1.9.3

v1.9.3

This release includes a number of bugfixes and compatibility improvements, particularly around SHA256 support.

libgit2 v1.8.5

v1.8.5

πŸ”’ This is a security release with multiple changes.

  • A bug in the external SSH execution is fixed that could cause arbitrary command execution. Remote repository names were improperly sent to the shell without quoting. Arguments to the external SSH command are now sent parameterized.

  • A bug in SSH credential creation is fixed that could cause a buffer overflow. Public keys that are not NUL terminated were improperly zeroed. The given length of public keys is now honored.

The libgit2 project thanks @0xkato and @bakersdozen123 for finding the bugs and providing details and reproduction steps.

All users of the v1.8 release line are recommended to upgrade.

Full Changelog: v1.8.4...v1.8.5

libgit2 v1.9.2

v1.9.2

πŸ”’ This is a security release with multiple changes.

  • A bug in the external SSH execution is fixed that could cause arbitrary command execution. Remote repository names were improperly sent to the shell without quoting. Arguments to the external SSH command are now sent parameterized.

  • A bug in SSH credential creation is fixed that could cause a buffer overflow. Public keys that are not NUL terminated were improperly zeroed. The given length of public keys is now honored.

The libgit2 project thanks @0xkato and @bakersdozen123 for finding the bugs and providing details and reproduction steps.

All users of the v1.9 release line are recommended to upgrade.

Full Changelog: v1.9.1...v1.9.2

libgit2 v1.9.1

What's Changed

Bug fixes

Build and CI improvements

Documentation improvements

  • docs: add update_refs as ABI breaking change by @ethomson in #7005
  • docs: correct wrong docstring info for git_remote_url by @DominiqueFuchs in #7076

New Contributors

Full Changelog: v1.9.0...v1.9.1

Read the original on github.com β†—