libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in HTTP transport in src/libgit2/transports/http.c follows an offsite initial redirect, and handle_remote_auth and handle_auth pass transport->owner->url instead of transport->server.url to the credential callback when the redirected host returns 401 Unauthorized. A callback that scopes credentials to the original trusted URL can therefore return GIT_CREDENTIAL_USERPASS_PLAINTEXT credentials that libgit2 stores in transport->server.cred and sends as an Authorization header to the redirected host. An attacker who controls a trusted Git host or an open redirect on that host can disclose HTTP Basic credentials, personal access tokens, or equivalent credentials. This issue is fixed in versions 1.8.6 and 1.9.5.

The remote Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8628-1 advisory.

    It was discovered that libgit2 incorrectly handled the Git Smart Protocol. A remote attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected     Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-10128)

    It was discovered that libgit2 incorrectly handled empty packet lines in the Git Smart Protocol. A remote     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04     LTS and Ubuntu 16.04 LTS. (CVE-2016-10129)

    It was discovered that libgit2 incorrectly handled error reporting in the HTTP transport. A remote     attacker could possibly use this issue to spoof servers. This issue only affected Ubuntu 16.04 LTS.
    (CVE-2016-10130)

    It was discovered that libgit2 incorrectly handled certain crafted ng packets. A remote attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu     16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2018-15501)

    Krishna Ram Prakash R and Vivek Parikh discovered that libgit2 incorrectly handled certain repository     index files. A local attacker could possibly use this issue to cause a denial of service. This issue only     affected Ubuntu 18.04 LTS. (CVE-2018-8098)

    Krishna Ram Prakash R and Vivek Parikh discovered that libgit2 incorrectly handled certain repository     index files. A local attacker could possibly use this issue to cause a denial of service. This issue only     affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2018-8099)

    Micha Majchrowicz and Marcin Wyczechowski discovered that libgit2 incorrectly handled submodule paths. A     remote attacker could possibly use this issue to write files outside the working tree. This issue only     affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-53584)

    Micha Majchrowicz and Marcin Wyczechowski discovered that libgit2 incorrectly handled delta object     result-size headers. A remote attacker could possibly use this issue to cause libgit2 to consume excessive     memory, leading to a denial of service. (CVE-2026-53585)

    Thai Son Dinh discovered that libgit2 incorrectly handled HTTP redirects. A remote attacker could possibly     use this issue to leak credentials to an offsite redirect target. This issue only affected Ubuntu 20.04     LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-53586)

    It was discovered that libgit2 incorrectly handled certain capability buffers in the smart protocol. A     remote attacker could possibly use this issue to cause a denial of service. This issue only affected     Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-53587)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid
    API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in
    HTTP transport in src/libgit2/transports/http.c follows an offsite initial redirect, and
    handle_remote_auth and handle_auth pass transport->owner->url instead of transport->server.url to the
    credential callback when the redirected host returns 401 Unauthorized. A callback that scopes credentials
    to the original trusted URL can therefore return GIT_CREDENTIAL_USERPASS_PLAINTEXT credentials that
    libgit2 stores in transport->server.cred and sends as an Authorization header to the redirected host. An
    attacker who controls a trusted Git host or an open redirect on that host can disclose HTTP Basic
    credentials, personal access tokens, or equivalent credentials. This issue is fixed in versions 1.8.6 and
    1.9.5. (CVE-2026-53586)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2083 advisory.

    libgit2 Inverted IP SubjectAltName Comparison in OpenSSL Backend ( vuln_1_1_1 ) (CVE-2026-53583)

    libgit2 Submodule path traversal (CVE-2026-53584)

    Unbounded Memory Allocation via Delta Object Result-Size Header (CVE-2026-53585)

    libgit2's builtin HTTP transport follows offsite redirects for the initial smart HTTP request by default.
    If the redirected server then returns 401 Unauthorized, libgit2 asks the application credential callback     for credentials using the original remote URL, not the redirected URL. The returned credential is then     attached to the next request to the redirected host as an Authorization header. (CVE-2026-53586)

    libgit2 version 1.9.4 and below is vulnerable to a heap out-of-bounds read in set_data() in     src/libgit2/transports/smart_pkt.c.

    The vulnerable code uses a fixed-size strncmp (smart_pkt.c:239) against the unvalidated capability buffer     of a smart-protocol pkt-line. When the bytes following the pkt-line in the contiguous receive buffer     happen to continue with ct-format=, the comparison spuriously matches, advancing format_str past the     pkt-line boundary. The following memchr(format_str, ' ', len - (format_str - line)) (smart_pkt.c:246) then     underflows its size_t size argument to ~SIZE_MAX and walks the heap looking for a space byte. An     unauthenticated remote attacker who controls (or man-in-the-middles) a Git server reached over     HTTP/HTTPS/SSH/git:// can trigger this on the FIRST ref-pkt of the refs advertisement, before any     capability negotiation has taken place. The OOB walk causes a process crash (SIGSEGV) when memchr enters     an unmapped page, and -- on heap layouts where memchr finds a stray space byte before crashing -- can     additionally drive the git_error_set(...'%.*s', format_len, format_str) formatter to copy a large window     of heap memory into the error string. (CVE-2026-53587)

    libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a     shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH     server by supplying a repository path containing unescaped shell metacharacters such as single quotes,     semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into     a shell command string without escaping special characters before passing it to libssh2_channel_exec(),     enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during     a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH     user account. (CVE-2026-5917)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6453 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6453-1                   security@debian.org     https://www.debian.org/security/                                  Aron Xu     August 20, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : libgit2     CVE ID         : CVE-2026-5917 CVE-2026-53583 CVE-2026-53584 CVE-2026-53585                      CVE-2026-53586 CVE-2026-53587     Debian Bug     : 1144465

    Multiple security issues were discovered in libgit2, a low-level Git     library, which could result in the execution of arbitrary commands on a     remote SSH server, disclosure of credentials, denial of service or the     creation of directories outside a repository's working tree.

    For the stable distribution (trixie), these problems have been fixed in     version 1.9.0+ds-2+deb13u1.

    We recommend that you upgrade your libgit2 packages.

    For the detailed security status of libgit2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libgit2

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2065 advisory.

    rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80,     CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectly sized output buffers when     used with AES key-wrap-with-padding ciphers EVP_aes_{128,192,256}_wrap_pad. For a non-multiple-of-8 input,     OpenSSL writes up to 7 bytes past the end of the caller's buffer or Vec, producing attacker-controllable     heap corruption when the plaintext length is attacker-influenced. This issue is fixed in version 0.10.80.
    (CVE-2026-45784)

    RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to     execute in constant-time and not be rewritten as branches by the compiler. From 0.1.1 until 0.5.4, the     aarch64 implementations of Cmov and CmovEq in cmov/src/backends/aarch64.rs assume high bits are zero-     extended when loading values smaller than a register, so set high bits such as [8..] in a Cmov selector or     [16..] of self or other in the u16 and i16 CmovEq implementations can cause left.cmovz(&right, condition)     to produce incorrect output. This issue is fixed in version 0.5.4. (CVE-2026-50185)

    libgit2 Inverted IP SubjectAltName Comparison in OpenSSL Backend ( vuln_1_1_1 ) (CVE-2026-53583)

    libgit2 Submodule path traversal (CVE-2026-53584)

    Unbounded Memory Allocation via Delta Object Result-Size Header (CVE-2026-53585)

    libgit2's builtin HTTP transport follows offsite redirects for the initial smart HTTP request by default.
    If the redirected server then returns 401 Unauthorized, libgit2 asks the application credential callback     for credentials using the original remote URL, not the redirected URL. The returned credential is then     attached to the next request to the redirected host as an Authorization header. (CVE-2026-53586)

    libgit2 version 1.9.4 and below is vulnerable to a heap out-of-bounds read in set_data() in     src/libgit2/transports/smart_pkt.c.

    The vulnerable code uses a fixed-size strncmp (smart_pkt.c:239) against the unvalidated capability buffer     of a smart-protocol pkt-line. When the bytes following the pkt-line in the contiguous receive buffer     happen to continue with ct-format=, the comparison spuriously matches, advancing format_str past the     pkt-line boundary. The following memchr(format_str, ' ', len - (format_str - line)) (smart_pkt.c:246) then     underflows its size_t size argument to ~SIZE_MAX and walks the heap looking for a space byte. An     unauthenticated remote attacker who controls (or man-in-the-middles) a Git server reached over     HTTP/HTTPS/SSH/git:// can trigger this on the FIRST ref-pkt of the refs advertisement, before any     capability negotiation has taken place. The OOB walk causes a process crash (SIGSEGV) when memchr enters     an unmapped page, and -- on heap layouts where memchr finds a stray space byte before crashing -- can     additionally drive the git_error_set(...'%.*s', format_len, format_str) formatter to copy a large window     of heap memory into the error string. (CVE-2026-53587)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of rust installed on the remote host is prior to 1.97.0-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3865 advisory.

    RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to     execute in constant-time and not be rewritten as branches by the compiler. From 0.1.1 until 0.5.4, the     aarch64 implementations of Cmov and CmovEq in cmov/src/backends/aarch64.rs assume high bits are zero-     extended when loading values smaller than a register, so set high bits such as [8..] in a Cmov selector or     [16..] of self or other in the u16 and i16 CmovEq implementations can cause left.cmovz(&right, condition)     to produce incorrect output. This issue is fixed in version 0.5.4. (CVE-2026-50185)

    libgit2 Inverted IP SubjectAltName Comparison in OpenSSL Backend ( vuln_1_1_1 ) (CVE-2026-53583)

    libgit2 Submodule path traversal (CVE-2026-53584)

    Unbounded Memory Allocation via Delta Object Result-Size Header (CVE-2026-53585)

    libgit2's builtin HTTP transport follows offsite redirects for the initial smart HTTP request by default.
    If the redirected server then returns 401 Unauthorized, libgit2 asks the application credential callback     for credentials using the original remote URL, not the redirected URL. The returned credential is then     attached to the next request to the redirected host as an Authorization header. (CVE-2026-53586)

    libgit2 version 1.9.4 and below is vulnerable to a heap out-of-bounds read in set_data() in     src/libgit2/transports/smart_pkt.c.

    The vulnerable code uses a fixed-size strncmp (smart_pkt.c:239) against the unvalidated capability buffer     of a smart-protocol pkt-line. When the bytes following the pkt-line in the contiguous receive buffer     happen to continue with ct-format=, the comparison spuriously matches, advancing format_str past the     pkt-line boundary. The following memchr(format_str, ' ', len - (format_str - line)) (smart_pkt.c:246) then     underflows its size_t size argument to ~SIZE_MAX and walks the heap looking for a space byte. An     unauthenticated remote attacker who controls (or man-in-the-middles) a Git server reached over     HTTP/HTTPS/SSH/git:// can trigger this on the FIRST ref-pkt of the refs advertisement, before any     capability negotiation has taken place. The OOB walk causes a process crash (SIGSEGV) when memchr enters     an unmapped page, and -- on heap layouts where memchr finds a stray space byte before crashing -- can     additionally drive the git_error_set(...'%.*s', format_len, format_str) formatter to copy a large window     of heap memory into the error string. (CVE-2026-53587)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-7ebec18d52 advisory.

    Rebuild applications that use libgit2 via the Rust bindings (git2 / libgit2-sys crates) with the latest     version of the libgit2-sys crate.

    This ensures applications now link against the libgit2 library provided by the system, which now includes     fixes for various security issues compared to the statically linked version of libgit2 that was previously     bundled in the libgit2-sys crate (CVE-2026-5917, CVE-2026-53586, CVE-2026-53587, CVE-2026-53585,     CVE-2026-53584, CVE-2026-53583, and others).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-74c4a6f82e advisory.

    Rebuild applications that use libgit2 via the Rust bindings (git2 / libgit2-sys crates) with the latest     version of the libgit2-sys crate.

    This ensures applications now link against the libgit2 library provided by the system, which now includes     fixes for various security issues compared to the statically linked version of libgit2 that was previously     bundled in the libgit2-sys crate (CVE-2026-5917, CVE-2026-53586, CVE-2026-53587, CVE-2026-53585,     CVE-2026-53584, CVE-2026-53583, and others).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-61dffcfbe9 advisory.

    - Update libgit2 to version 1.9.6.
    - Update the libgit2-sys Rust crate to the corresponding version 0.18.7.

    This includes fixes for various security issues, including - but not limited to:

    - [CVE-2026-53583](https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp)
    - [CVE-2026-53584](https://github.com/libgit2/libgit2/security/advisories/GHSA-cw77-j82w-mchm)
    - [CVE-2026-53585](https://github.com/libgit2/libgit2/security/advisories/GHSA-27m5-gxxh-x79j)
    - [CVE-2026-53586](https://github.com/libgit2/libgit2/security/advisories/GHSA-2889-x8f6-mc4x)
    - [CVE-2026-53587](https://github.com/libgit2/libgit2/security/advisories/GHSA-pm24-4jhq-3xvm)

    The Fedora package is not affected by [GHSA-     wfx7-g85r-q6vw](https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp) since Fedora     packages always linked the system PCRE2 and did not use the bundled PCRE.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid     API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in     HTTP transport in src/libgit2/transports/http.c follows an offsite initial redirect, and     handle_remote_auth and handle_auth pass transport->owner->url instead of transport->server.url to the     credential callback when the redirected host returns 401 Unauthorized. A callback that scopes credentials     to the original trusted URL can therefore return GIT_CREDENTIAL_USERPASS_PLAINTEXT credentials that     libgit2 stores in transport->server.cred and sends as an Authorization header to the redirected host. An     attacker who controls a trusted Git host or an open redirect on that host can disclose HTTP Basic     credentials, personal access tokens, or equivalent credentials. This issue is fixed in versions 1.8.6 and     1.9.5. (CVE-2026-53586)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-9d59721e9b advisory.

    - Update libgit2 to version 1.9.6.
    - Update the libgit2-sys Rust crate to the corresponding version 0.18.7.

    This includes fixes for various security issues, including - but not limited to:

    - [CVE-2026-53583](https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp)
    - [CVE-2026-53584](https://github.com/libgit2/libgit2/security/advisories/GHSA-cw77-j82w-mchm)
    - [CVE-2026-53585](https://github.com/libgit2/libgit2/security/advisories/GHSA-27m5-gxxh-x79j)
    - [CVE-2026-53586](https://github.com/libgit2/libgit2/security/advisories/GHSA-2889-x8f6-mc4x)
    - [CVE-2026-53587](https://github.com/libgit2/libgit2/security/advisories/GHSA-pm24-4jhq-3xvm)

    The Fedora package is not affected by [GHSA-     wfx7-g85r-q6vw](https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp) since Fedora     packages always linked the system PCRE2 and did not use the bundled PCRE.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-7c3fc14617 advisory.

    - Update libgit2 to version 1.9.6.
    - Update the libgit2-sys Rust crate to the corresponding version 0.18.7.

    This includes fixes for various security issues, including - but not limited to:

    - [CVE-2026-53583](https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp)
    - [CVE-2026-53584](https://github.com/libgit2/libgit2/security/advisories/GHSA-cw77-j82w-mchm)
    - [CVE-2026-53585](https://github.com/libgit2/libgit2/security/advisories/GHSA-27m5-gxxh-x79j)
    - [CVE-2026-53586](https://github.com/libgit2/libgit2/security/advisories/GHSA-2889-x8f6-mc4x)
    - [CVE-2026-53587](https://github.com/libgit2/libgit2/security/advisories/GHSA-pm24-4jhq-3xvm)

    The Fedora package is not affected by [GHSA-     wfx7-g85r-q6vw](https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp) since Fedora     packages always linked the system PCRE2 and did not use the bundled PCRE.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
365444	Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : libgit2 vulnerabilities (USN-8628-1)	Nessus	Ubuntu Local Security Checks	Local	critical
464354	Echo: libgit2: security update to 1.9.0+ds-2+deb13u1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
464354	Echo: libgit2: security update to 1.9.0+ds-2+deb13u1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
341845	Amazon Linux 2023 : libgit2, libgit2-devel (ALAS2023-2026-2083)	Nessus	Amazon Linux Local Security Checks	Local	high
338355	Debian dsa-6453 : libgit2-1.9 - security update	Nessus	Debian Local Security Checks	Local	high
337244	Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2026-2065)	Nessus	Amazon Linux Local Security Checks	Local	medium
337227	Amazon Linux 2 : rust, --advisory ALAS2-2026-3865 (ALAS-2026-3865)	Nessus	Amazon Linux Local Security Checks	Local	low
335948	Fedora 43 : rust-bat / rust-git-delta / rust-git-interactive-rebase-tool / etc (2026-7ebec18d52)	Nessus	Fedora Local Security Checks	Local	high
335900	Fedora 44 : rust-bat / rust-git-delta / rust-git-interactive-rebase-tool / etc (2026-74c4a6f82e)	Nessus	Fedora Local Security Checks	Local	high
331601	Fedora 43 : libgit2 / rust-libgit2-sys (2026-61dffcfbe9)	Nessus	Fedora Local Security Checks	Local	medium
331302	Linux Distros Unpatched Vulnerability : CVE-2026-53586	Nessus	Misc.	Local	medium
330052	Fedora 44 : libgit2 / rust-libgit2-sys (2026-9d59721e9b)	Nessus	Fedora Local Security Checks	Local	medium
329273	Fedora 45 : libgit2_1.9 / rust-libgit2-sys (2026-7c3fc14617)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2026-53586

medium

Tenable Plugins

critical

medium

medium

high

high

medium

low

high

high

medium

medium

medium

medium