Every CVE Search/ Get API key

CVE-2016-3069

Mercurial vulnerable to arbitrary code execution via a crafted name when converting a Git repository

8.8 HighFix available

CVE-2016-3069 is a high vulnerability (CVSS 8.8) in Mercurial, published April 5, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.95%, the 92nd percentile. Fixed in mercurial 3.7.3.

Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

4.95%Down 2.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 8.8

Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.

Record
CVE-2016-3069
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.

Record
CVE-2016-3069
Updated
2026-11-02
EUVDEUVD-2016-0015 No score

Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.

Record
EUVD-2016-0015
Updated
2026-11-03
GitHub AdvisoriesGHSA-8fm8-7365-5rh2 8.7

Mercurial vulnerable to arbitrary code execution via a crafted name when converting a Git repository

Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.

Record
GHSA-8fm8-7365-5rh2
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
OSV 8.8

Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.

Record
CVE-2016-3069
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2016-3069 8.8

Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.

Record
DEBIAN-CVE-2016-3069
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVGHSA-8fm8-7365-5rh2 8.7

Mercurial vulnerable to arbitrary code execution via a crafted name when converting a Git repository

Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.

Record
GHSA-8fm8-7365-5rh2
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
OSVUBUNTU-CVE-2016-3069 8.8

Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.

Record
UBUNTU-CVE-2016-3069
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2016-0138 No score

Updated mercurial packages fix security vulnerabilities

Updated mercurial packages fix security vulnerabilities:

Blake Burkhart discovered that Mercurial allows URLs for Git subrepositories that could result in arbitrary code execution on clone (CVE-2016-3068).

Blake Burkhart discovered that Mercurial allows arbitrary code execution when converting Git repositories with specially crafted names (CVE-2016-3069).

It was discovered that Mercurial does not properly perform bounds-checking in its binary delta decoder, which may be exploitable for remote code execution via clone, push or pull (CVE-2016-3630).

Record
MGASA-2016-0138
Updated
2026-11-02
OSVopenSUSE-SU-2024:10070-1 No score

mercurial-4.0-1.1 on GA media

These are all security issues fixed in the mercurial-4.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10070-1
Updated
2026-11-02
OSVPYSEC-2016-27 No score

Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.

Record
PYSEC-2016-27
Updated
2026-11-02
OSVSUSE-SU-2016:1010-1 No score

Security update for mercurial

mercurial was updated to fix three security issues.

These security issues were fixed:

  • CVE-2016-3069: Arbitrary code execution when converting Git repos (bsc#973176).
  • CVE-2016-3068: Arbitrary code execution with Git subrepos (bsc#973177).
  • CVE-2016-3630: Remote code execution in binary delta decoding (bsc#973175).
Record
SUSE-SU-2016:1010-1
Updated
2026-11-02
OSVSUSE-SU-2016:1011-1 No score

Security update for mercurial

mercurial was updated to fix three security issues.

These security issues were fixed:

  • CVE-2016-3069: Arbitrary code execution when converting Git repos (bsc#973176).
  • CVE-2016-3068: Arbitrary code execution with Git subrepos (bsc#973177).
  • CVE-2016-3630: Remote code execution in binary delta decoding (bsc#973175).
Record
SUSE-SU-2016:1011-1
Updated
2026-11-02

Affected products

Show 2 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
mercurial
PyPI
 before 3.7.3
3.7.3
mercurial
Debian:12
 before 3.7.3-1
3.7.3-1
mercurial
Debian:13
 before 3.7.3-1
3.7.3-1
mercurial
Debian:14
 before 3.7.3-1
3.7.3-1
mercurial
Debian:7
 before 2.2.2-4+deb7u2, plus listed versions
2.2.2-32.2.2-42.2.2-4+deb7u1
2.2.2-4+deb7u2
mercurial
Debian:8
 before 3.1.2-2+deb8u2, plus listed versions
3.1.2-23.1.2-2+deb8u1
3.1.2-2+deb8u2
mercurial
PyPI
 before 3.7.3, plus listed versions
0.8.10.90.9.10.9.20.9.3
Show 45 moreShow less
0.9.40.9.51.01.0.11.0.21.11.1.11.1.21.21.2.11.31.3.11.41.4.11.4.21.4.31.51.5.11.5.21.5.31.5.41.61.6.11.6.21.6.31.6.41.71.7.11.7.21.7.31.7.51.81.8.11.8.21.8.31.8.41.91.9.11.9.21.9.32.02.0.12.0.22.12.1.1
3.7.3
mercurial
Mageia:5
 before 3.1.1-5.1.mga5
3.1.1-5.1.mga5
emacs-mercurial
Red Hat:enterprise_linux:7::client
 before 0:2.6.2-6.el7_2
0:2.6.2-6.el7_2
emacs-mercurial-el
Red Hat:enterprise_linux:7::client
 before 0:2.6.2-6.el7_2
0:2.6.2-6.el7_2
Show 23 moreShow less
Affected packages
PackageAffectedFixed
mercurial
Red Hat:enterprise_linux:7::client
 before 0:2.6.2-6.el7_2
0:2.6.2-6.el7_2
mercurial-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:2.6.2-6.el7_2
0:2.6.2-6.el7_2
mercurial-hgk
Red Hat:enterprise_linux:7::client
 before 0:2.6.2-6.el7_2
0:2.6.2-6.el7_2
emacs-mercurial
Red Hat:enterprise_linux:7::computenode
 before 0:2.6.2-6.el7_2
0:2.6.2-6.el7_2
emacs-mercurial-el
Red Hat:enterprise_linux:7::computenode
 before 0:2.6.2-6.el7_2
0:2.6.2-6.el7_2
mercurial
Red Hat:enterprise_linux:7::computenode
 before 0:2.6.2-6.el7_2
0:2.6.2-6.el7_2
mercurial-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:2.6.2-6.el7_2
0:2.6.2-6.el7_2
mercurial-hgk
Red Hat:enterprise_linux:7::computenode
 before 0:2.6.2-6.el7_2
0:2.6.2-6.el7_2
mercurial
Red Hat:enterprise_linux:7::server
 before 0:2.6.2-6.el7_2
0:2.6.2-6.el7_2
mercurial-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:2.6.2-6.el7_2
0:2.6.2-6.el7_2
emacs-mercurial
Red Hat:enterprise_linux:7::server
 before 0:2.6.2-6.el7_2
0:2.6.2-6.el7_2
emacs-mercurial-el
Red Hat:enterprise_linux:7::server
 before 0:2.6.2-6.el7_2
0:2.6.2-6.el7_2
mercurial-hgk
Red Hat:enterprise_linux:7::server
 before 0:2.6.2-6.el7_2
0:2.6.2-6.el7_2
mercurial
Red Hat:enterprise_linux:7::workstation
 before 0:2.6.2-6.el7_2
0:2.6.2-6.el7_2
mercurial-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:2.6.2-6.el7_2
0:2.6.2-6.el7_2
emacs-mercurial
Red Hat:enterprise_linux:7::workstation
 before 0:2.6.2-6.el7_2
0:2.6.2-6.el7_2
emacs-mercurial-el
Red Hat:enterprise_linux:7::workstation
 before 0:2.6.2-6.el7_2
0:2.6.2-6.el7_2
mercurial-hgk
Red Hat:enterprise_linux:7::workstation
 before 0:2.6.2-6.el7_2
0:2.6.2-6.el7_2
mercurial
SUSE:Linux Enterprise Software Development Kit 12
 before 2.8.2-6.1
2.8.2-6.1
mercurial
SUSE:Linux Enterprise Software Development Kit 12 SP1
 before 2.8.2-6.1
2.8.2-6.1
mercurial
SUSE:Linux Enterprise Software Development Kit 11 SP4
 before 2.3.2-0.11.1
2.3.2-0.11.1
mercurial
Ubuntu:14.04:LTS
 before 2.8.2-1ubuntu1.4, plus listed versions
2.6.3-12.7.2-12.8.1-22.8.2-1ubuntu12.8.2-1ubuntu1.3
2.8.2-1ubuntu1.4
mercurial
openSUSE:Tumbleweed
 before 4.0-1.1
4.0-1.1

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 38 moreShow less
This page doesn't list everything

Left out here: 52 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open