CVE-2026-53587: 
Bat vulnerability analysis and mitigation

CVE-2026-53587 is a heap out-of-bounds read vulnerability in libgit2's smart protocol transport layer, specifically in the set_data() function within src/libgit2/transports/smart_pkt.c. It affects libgit2 versions v1.6.1 through v1.9.4 (every tagged release from February 2023 through May 2026), as well as the libgit2-sys Rust crate prior to version 0.18.7. An unauthenticated remote attacker who controls or man-in-the-middles a Git server can trigger a process crash (denial of service) and potentially expose heap memory contents. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) for server-side/CI deployments (UI:N) and 6.5 (Medium) for user-initiated desktop scenarios (UI:R) (GitHub Advisory, Ubuntu Advisory).

The root cause is improper input validation (CWE-20, CWE-125, CWE-126, CWE-1284) in set_data() at smart_pkt.c:239, where a fixed-size strncmp(caps, "object-format=", 14) is performed against the capability buffer without first verifying that 14 bytes remain within the current pkt-line boundary. When the NUL byte sits near the tail of the pkt-line and the next bytes in the contiguous receive buffer spell out the remainder of "object-format=", the comparison spuriously matches, advancing format_str past the pkt-line boundary. The subsequent memchr(format_str, ' ', len - (format_str - line)) at line 246 then underflows its size_t argument to approximately SIZE_MAX, causing memchr to walk the heap until it hits an unmapped page (SIGSEGV) or — on favorable heap layouts — finds a stray space byte and drives git_error_set() to copy a large window of heap memory into the error string. The attack is triggered on the very first ref-pkt of the refs advertisement, before any authentication or capability negotiation, via git_clone(), git_remote_ls(), or git_remote_fetch() (GitHub Advisory).

Successful exploitation guarantees a process crash (SIGSEGV) on every libgit2-mediated fetch from a malicious server, enabling sustained denial of service against mirror-sync workers, CI runners, and Git hosting indexers. On heap layouts where memchr finds a stray space byte before reaching unmapped memory, heap contents from an attacker-controlled window are copied into the libgit2 error string and may be surfaced in CI build logs or web UI error panes, elevating confidentiality impact to Low. Affected real-world consumers include GitHub Desktop, Microsoft Azure DevOps, Atlassian SourceTree, Gitea/Forgejo, GitLab Importer, Bitbucket Server, GitKraken, and any CI runner using libgit2 via pygit2, git2go, rugged, or nodegit bindings (GitHub Advisory).

A working proof-of-concept (PoC) has been publicly disclosed in the GitHub Security Advisory, including full source code (poc.cpp) and a crafted HTTP response payload that triggers the vulnerability. The PoC was runtime-tested under AddressSanitizer on Ubuntu 22.04 with clang-15, confirming SIGSEGV in memchr called from smart_pkt.c:246. No authentication is required; the attack fires on the first ref-pkt before any capability negotiation, and server-side mirror-sync deployments require zero per-attempt user interaction. As of the time of reporting, the CVE status is listed as "Reserved" and no CISA KEV listing or EPSS score is publicly available; no threat actor attribution has been reported (GitHub Advisory).

1. Set up a malicious Git server: Host an HTTP server that responds to GET /info/refs?service=git-upload-pack with a crafted application/x-git-upload-pack-advertisement response body.
2. Craft the malicious pkt-line payload: Build a pkt-line where the NUL capability separator sits near the tail of the declared pkt-line length, and the bytes immediately following in the buffer spell out "ct-format=" — completing "object-format=" when strncmp reads past the pkt-line boundary. Example (PoC1): 0048 + 63×'A' + 0x00 + "obje" (within pkt-line) + "ct-format=" + 16×'F' (outside pkt-line, in the same receive buffer).
3. Lure or wait for a victim: Either socially engineer a user to run git clone http://attacker/x.git (or equivalent libgit2-based operation), or target a server-side mirror-sync/CI auto-fetch that periodically fetches from attacker-controlled URLs — no user interaction required in the latter case.
4. Trigger the OOB read: When the victim's libgit2 processes the first ref-pkt, set_data() performs the unbounded strncmp, spuriously matches, and calls memchr with a size_t argument underflowed to ~SIZE_MAX.
5. Achieve denial of service: memchr walks the heap until hitting an unmapped page, causing SIGSEGV and crashing the libgit2 process. On favorable heap layouts, heap memory is additionally copied into the error string and may be exposed in logs or UI.
6. Sustain the attack: Repeat the malicious response on every connection attempt; long-running services (mirror-sync workers, CI runners) will crash and restart in a loop, achieving persistent denial of service (GitHub Advisory).

• Network: Unexpected HTTP responses to GET /info/refs?service=git-upload-pack with Content-Type: application/x-git-upload-pack-advertisement containing pkt-lines where the declared length does not match the actual capability data; specifically, pkt-lines with a NUL near the tail followed by bytes that form "object-format=" when read across the boundary.
• Process: Sudden SIGSEGV crashes of processes using libgit2 (e.g., git, gitea, gitlab-workhorse, CI runner agents, pygit2-based scripts) with stack traces referencing memchr → set_data (smart_pkt.c:246) → ref_pkt (smart_pkt.c:291) → git_pkt_parse_line.
• Logs: AddressSanitizer output (if enabled) reporting SEGV on unknown address with the call chain set_data smart_pkt.c:246; application logs showing repeated git fetch/clone failures against the same remote URL followed by process restarts.
• File System: Core dump files generated by libgit2-consuming processes crashing with SIGSEGV, potentially containing heap memory contents (GitHub Advisory).

The upstream libgit2 project had not released a patch at the time of initial disclosure (the advisory notes "Not patched" for versions ≤ 1.9.4); however, Feedly data indicates that updating to libgit2 1.9.6 (and the libgit2-sys Rust crate to 0.18.7) resolves the issue. Ubuntu has released patched packages via USN-8628-1: Ubuntu 26.04 LTS (libgit2-1.9 1.9.1+ds-1ubuntu1.1), Ubuntu 24.04 LTS (libgit2-1.7 1.7.2+ds-1ubuntu3.1), and older releases via Ubuntu Pro ESM. The recommended code-level fix is to add a bounds check before the strncmp at smart_pkt.c:239: replace strncmp(caps, "object-format=", CONST_STRLEN("object-format=")) with a guard if (len - (caps - line) >= CONST_STRLEN("object-format=") && memcmp(caps, "object-format=", CONST_STRLEN("object-format=")) == 0). As a workaround where patching is not immediately possible, restrict network access to Git servers to trusted sources only, and avoid exposing libgit2-based mirror-sync or CI auto-fetch services to untrusted remote URLs (GitHub Advisory, Ubuntu Advisory).

The vulnerability was reported by researcher manop55555 and published as GitHub Security Advisory GHSA-pm24-4jhq-3xvm by ethomson on July 18, 2026. OpenSUSE, Fedora, Debian, and Ubuntu all issued security advisories and package updates within weeks of disclosure, indicating broad distribution-level response. Tenable published multiple Nessus detection plugins (IDs 329273, 330052, 331309, 331305, 331311, 331312, 331601) and Qualys added detection (IDs 6567117, 6036203), reflecting rapid scanner coverage. German security outlet Pro-Linux.de covered the issue across multiple libgit2 advisories, and LinuxSecurity.com reported on Fedora's rust-libgit2-sys updates (GitHub Advisory, Ubuntu Advisory).