There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2)
    contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands
    on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single
    quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path
    directly into a shell command string without escaping special characters before passing it to
    libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file
    that, when processed during a recursive clone, causes the remote server's shell to interpret injected
    commands under the victim's SSH user account. (CVE-2026-5917)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2113 advisory.

    libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a     shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH     server by supplying a repository path containing unescaped shell metacharacters such as single quotes,     semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into     a shell command string without escaping special characters before passing it to libssh2_channel_exec(),     enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during     a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH     user account. (CVE-2026-5917)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-74c4a6f82e advisory.

    Rebuild applications that use libgit2 via the Rust bindings (git2 / libgit2-sys crates) with the latest     version of the libgit2-sys crate.

    This ensures applications now link against the libgit2 library provided by the system, which now includes     fixes for various security issues compared to the statically linked version of libgit2 that was previously     bundled in the libgit2-sys crate (CVE-2026-5917, CVE-2026-53586, CVE-2026-53587, CVE-2026-53585,     CVE-2026-53584, CVE-2026-53583, and others).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-7ebec18d52 advisory.

    Rebuild applications that use libgit2 via the Rust bindings (git2 / libgit2-sys crates) with the latest     version of the libgit2-sys crate.

    This ensures applications now link against the libgit2 library provided by the system, which now includes     fixes for various security issues compared to the statically linked version of libgit2 that was previously     bundled in the libgit2-sys crate (CVE-2026-5917, CVE-2026-53586, CVE-2026-53587, CVE-2026-53585,     CVE-2026-53584, CVE-2026-53583, and others).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2083 advisory.

    libgit2 Inverted IP SubjectAltName Comparison in OpenSSL Backend ( vuln_1_1_1 ) (CVE-2026-53583)

    libgit2 Submodule path traversal (CVE-2026-53584)

    Unbounded Memory Allocation via Delta Object Result-Size Header (CVE-2026-53585)

    libgit2's builtin HTTP transport follows offsite redirects for the initial smart HTTP request by default.
    If the redirected server then returns 401 Unauthorized, libgit2 asks the application credential callback     for credentials using the original remote URL, not the redirected URL. The returned credential is then     attached to the next request to the redirected host as an Authorization header. (CVE-2026-53586)

    libgit2 version 1.9.4 and below is vulnerable to a heap out-of-bounds read in set_data() in     src/libgit2/transports/smart_pkt.c.

    The vulnerable code uses a fixed-size strncmp (smart_pkt.c:239) against the unvalidated capability buffer     of a smart-protocol pkt-line. When the bytes following the pkt-line in the contiguous receive buffer     happen to continue with ct-format=, the comparison spuriously matches, advancing format_str past the     pkt-line boundary. The following memchr(format_str, ' ', len - (format_str - line)) (smart_pkt.c:246) then     underflows its size_t size argument to ~SIZE_MAX and walks the heap looking for a space byte. An     unauthenticated remote attacker who controls (or man-in-the-middles) a Git server reached over     HTTP/HTTPS/SSH/git:// can trigger this on the FIRST ref-pkt of the refs advertisement, before any     capability negotiation has taken place. The OOB walk causes a process crash (SIGSEGV) when memchr enters     an unmapped page, and -- on heap layouts where memchr finds a stray space byte before crashing -- can     additionally drive the git_error_set(...'%.*s', format_len, format_str) formatter to copy a large window     of heap memory into the error string. (CVE-2026-53587)

    libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a     shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH     server by supplying a repository path containing unescaped shell metacharacters such as single quotes,     semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into     a shell command string without escaping special characters before passing it to libssh2_channel_exec(),     enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during     a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH     user account. (CVE-2026-5917)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0951 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-5917:
    libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a     shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH     server by supplying a repository path containing unescaped shell metacharacters such as single quotes,     semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into     a shell command string without escaping special characters before passing it to libssh2_channel_exec(),     enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during     a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH     user account.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4831 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4831-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Simon Quigley     October 12, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libgit2     Version        : 1.5.1+ds-1+deb12u2     CVE ID         : CVE-2026-5917 CVE-2026-53584 CVE-2026-53585 CVE-2026-53586     Debian Bug     : 1144465

    Multiple security issues were discovered in libgit2, a low-level Git     library, which could result in path traversal, denial of service,     credential leaks, or the execution of arbitrary commands on an SSH     server.

    CVE-2026-5917

        The repository path was placed unescaped inside single quotes in         the command sent to the server over SSH, so a path containing a         single quote could execute arbitrary commands on the SSH server.
        The path is now escaped.

    CVE-2026-53584

        Submodule paths read from .gitmodules were not checked for ..,         so a malicious repository could make submodule lookup, add, init         or update operate outside the working tree. Such paths are now         rejected.

    CVE-2026-53585

        Delta application allocated whatever result size the delta header         declared, so a small malicious packfile could force huge memory         allocations, leading to a denial of service. Objects produced by         delta application are now limited to 2 GiB by default; the limit         can be changed with GIT_OPT_SET_PACK_MAX_OBJECT_SIZE.

    CVE-2026-53586

        After an offsite redirect on the initial HTTP request, the         credential callback was still given the original URL, so a         credential helper could hand the credentials for the original host         to the redirect target. The callback now receives the host that is         actually being contacted.

    For Debian 12 bookworm, these problems have been fixed in version     1.5.1+ds-1+deb12u2.

    We recommend that you upgrade your libgit2 packages.

    For the detailed security status of libgit2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libgit2

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6453 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6453-1                   security@debian.org     https://www.debian.org/security/                                  Aron Xu     August 20, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : libgit2     CVE ID         : CVE-2026-5917 CVE-2026-53583 CVE-2026-53584 CVE-2026-53585                      CVE-2026-53586 CVE-2026-53587     Debian Bug     : 1144465

    Multiple security issues were discovered in libgit2, a low-level Git     library, which could result in the execution of arbitrary commands on a     remote SSH server, disclosure of credentials, denial of service or the     creation of directories outside a repository's working tree.

    For the stable distribution (trixie), these problems have been fixed in     version 1.9.0+ds-2+deb13u1.

    We recommend that you upgrade your libgit2 packages.

    For the detailed security status of libgit2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libgit2

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8809-1 advisory.

    Kazuma Matsumoto and Isabel Mill discovered that libgit2 incorrectly handled certain repository URLs when     using the SSH transport. A remote attacker could possibly use this issue to execute arbitrary commands.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
460769	Echo: libgit2: security update to 1.9.0+ds-2+deb13u1	Tenable Cloud Security	Echo Local Security Checks	10/2/2026	10/2/2026	high
460769	Echo: libgit2: security update to 1.9.0+ds-2+deb13u1	Tenable Self-Hosted Container Security	Echo Local Security Checks	10/2/2026	10/2/2026	high
342044	Amazon Linux 2023 : cargo-c (ALAS2023-2026-2113)	Nessus	Amazon Linux Local Security Checks	8/31/2026	8/31/2026	high
335900	Fedora 44 : rust-bat / rust-git-delta / rust-git-interactive-rebase-tool / etc (2026-74c4a6f82e)	Nessus	Fedora Local Security Checks	8/16/2026	9/18/2026	high
335948	Fedora 43 : rust-bat / rust-git-delta / rust-git-interactive-rebase-tool / etc (2026-7ebec18d52)	Nessus	Fedora Local Security Checks	8/17/2026	9/18/2026	high
341845	Amazon Linux 2023 : libgit2, libgit2-devel (ALAS2023-2026-2083)	Nessus	Amazon Linux Local Security Checks	8/31/2026	9/18/2026	high
342217	TencentOS Server 4: rust (TSSA-2026:0951)	Nessus	Tencent Local Security Checks	9/1/2026	9/1/2026	high
370004	Debian dla-4831 : libgit2-1.5 - security update	Nessus	Debian Local Security Checks	10/21/2026	10/21/2026	high
338355	Debian dsa-6453 : libgit2-1.9 - security update	Nessus	Debian Local Security Checks	8/20/2026	9/18/2026	high
349786	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : libgit2 vulnerability (USN-8809-1)	Nessus	Ubuntu Local Security Checks	9/24/2026	10/14/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high