CVE-2009-2108
git-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to cause a denial of service ...
git-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request containing extra unrecognized arguments.
Exploit likelihood
What each source reports
NVD Score used
git-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request containing extra unrecognized arguments.
- Record
CVE-2009-2108- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
git-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request containing extra unrecognized arguments.
- Record
CVE-2009-2108- Updated
- 2026-11-02
EUVDEUVD-2009-2104 No score
git-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request containing extra unrecognized arguments.
- Record
EUVD-2009-2104- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wfjh-r5w7-m7m6 No score
git-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to cause a denial of service ...
git-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request containing extra unrecognized arguments.
- Record
GHSA-wfjh-r5w7-m7m6- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
git-coreDebian:4.0 |
before 1:1.4.4.4-4+etch3, plus listed versions 1:1.4.4.4-21:1.4.4.4-2.1+etch11:1.4.4.4-31:1.4.4.4-41:1.4.4.4-4+etch11:1.4.4.4-4+etch2 |
1:1.4.4.4-4+etch3 |
git-coreDebian:5.0 |
before 1:1.5.6.5-3+lenny2, plus listed versions 1:1.5.6.5-21:1.5.6.5-31:1.5.6.5-3+lenny11:1.5.6.5-3+lenny2~bpo40+1 |
1:1.5.6.5-3+lenny2 |
git-coreDebian:4.0 |
before 1:1.4.4.4-4+etch4, plus listed versions 1:1.4.4.4-21:1.4.4.4-2.1+etch11:1.4.4.4-31:1.4.4.4-41:1.4.4.4-4+etch11:1.4.4.4-4+etch21:1.4.4.4-4+etch3 |
1:1.4.4.4-4+etch4 |
git-coreDebian:5.0 |
before 1:1.5.6.5-3+lenny3, plus listed versions 1:1.5.6.5-21:1.5.6.5-31:1.5.6.5-3+lenny11:1.5.6.5-3+lenny21:1.5.6.5-3+lenny2~bpo40+1 |
1:1.5.6.5-3+lenny3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Git 1.6.3 - Parameter Processing Remote Denial of Service | 2009-05-05 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-2108 is a medium vulnerability (CVSS 5.0) in Git, published June 18, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.82%, the 93rd percentile. Fixed in git-core 1:1.4.4.4-4+etch3.
References
securitytracker.com/id?1022398
vupen.com/english/advisories/2009/1579
exchange.xforce.ibmcloud.com/vulnerabilities/51083
thread.gmane.org/gmane.comp.version-control.git/120724
redhat.com/archives/fedora-security-list/2009-June/msg00000.html
osvdb.org/55034
Show 12 moreShow less
secunia.com/advisories/35730
securityfocus.com/bid/35338
security.gentoo.org/glsa/glsa-200907-05.xml
mandriva.com/security/advisories?name=MDVSA-2009:155
article.gmane.org/gmane.comp.version-control.git/120733
openwall.com/lists/oss-security/2009/06/12/1
nvd.nist.gov/vuln/detail/CVE-2009-2108
github.com/advisories/GHSA-wfjh-r5w7-m7m6