CVE-2022-24975
The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted...
The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security risk if information-disclosure auditing processes rely on a clone operation without the --mirror option. Note: This has been disputed by multiple 3rd parties who believe this is an intended feature of the git binary and does not pose a security risk.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security risk if information-disclosure auditing processes rely on a clone operation without the --mirror option. Note: This has been disputed by multiple 3rd parties who believe this is an intended feature of the git binary and does not pose a security risk.
- Record
CVE-2022-24975- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-668
- Updated
- 2026-11-02
CVE List No score
The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security risk if information-disclosure auditing processes rely on a clone operation without the --mirror option. Note: This has been disputed by multiple 3rd parties who believe this is an intended feature of the git binary and does not pose a security risk.
- Record
CVE-2022-24975- Updated
- 2026-11-02
EUVDEUVD-2022-29725 No score
The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security risk if information-disclosure auditing processes rely on a clone operation without the --mirror option. Note: This has been disputed by multiple 3rd parties who believe this is an intended feature of the git binary and does not pose a security risk.
- Record
EUVD-2022-29725- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wx8f-p63x-543f
The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted...
The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security risk if information-disclosure auditing processes rely on a clone operation without the --mirror option.
- Record
GHSA-wx8f-p63x-543f- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-668
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-24975
The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security risk if information-disclosure auditing processes rely on a clone operation without the --mirror option. Note: This has been disputed by multiple 3rd parties who believe this is an intended feature of the git binary and does not pose a security risk.
- Record
DEBIAN-CVE-2022-24975- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
OSVUBUNTU-CVE-2022-24975
The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security risk if information-disclosure auditing processes rely on a clone operation without the --mirror option. Note: This has been disputed by multiple 3rd parties who believe this is an intended feature of the git binary and does not pose a security risk.
- Record
UBUNTU-CVE-2022-24975- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSV No score
The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security risk if information-disclosure auditing processes rely on a clone operation without the --mirror option. Note: This has been disputed by multiple 3rd parties who believe this is an intended feature of the git binary and does not pose a security risk.
- Record
CVE-2022-24975- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2022-24975 No score
CVE-2022-24975 in git - Patched by Root
Root has patched CVE-2022-24975 in the git package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2022-24975- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gitDebian:12 |
All versions, plus listed versions 1:2.39.2+next.20230215-11:2.39.2-1.11:2.39.5-0+deb12u11:2.39.5-0+deb12u21:2.39.5-0+deb12u3 Show 41 moreShow less1:2.40.0+next.20230313-11:2.40.0+next.20230319-11:2.40.0-11:2.40.0-1+alpha.11:2.40.1+next.20230424-11:2.40.1+next.20230427-11:2.40.1-11:2.40.1-1+alpha.11:2.42.0-11:2.43.0+next.20231120-11:2.43.0+next.20240104-11:2.43.0-11:2.43.0-1+alpha.21:2.45.1+next.20240516-11:2.45.1-11:2.45.2+next.20240614-11:2.45.2-11:2.45.2-1+alpha.11:2.45.2-1.11:2.45.2-1.1+alpha.11:2.45.2-1.21:2.45.2-1.31:2.47.1-11:2.47.2-0.11:2.47.2-0.21:2.48.0~rc1+next.20250101-11:2.49.0+next.20250314-11:2.49.0-11:2.49.0-21:2.49.0-31:2.50.0+next.20250615-11:2.50.0-11:2.50.0~rc0+next.20250528-11:2.50.1-0.11:2.51.0+next.20250825-11:2.51.0-11:2.53.0+next.20260227-11:2.53.0-11:2.53.0-1+hurd.11:2.55.0+next.20260731-11:2.55.0-1 |
None known |
gitDebian:13 |
All versions, plus listed versions 1:2.47.2-0.21:2.47.3-0+deb13u11:2.48.0~rc1+next.20250101-11:2.49.0+next.20250314-11:2.49.0-1 Show 13 moreShow less1:2.49.0-21:2.49.0-31:2.50.0+next.20250615-11:2.50.0-11:2.50.0~rc0+next.20250528-11:2.50.1-0.11:2.51.0+next.20250825-11:2.51.0-11:2.53.0+next.20260227-11:2.53.0-11:2.53.0-1+hurd.11:2.55.0+next.20260731-11:2.55.0-1 |
None known |
gitDebian:14 |
All versions, plus listed versions 1:2.47.2-0.21:2.48.0~rc1+next.20250101-11:2.49.0+next.20250314-11:2.49.0-11:2.49.0-2 Show 12 moreShow less1:2.49.0-31:2.50.0+next.20250615-11:2.50.0-11:2.50.0~rc0+next.20250528-11:2.50.1-0.11:2.51.0+next.20250825-11:2.51.0-11:2.53.0+next.20260227-11:2.53.0-11:2.53.0-1+hurd.11:2.55.0+next.20260731-11:2.55.0-1 |
None known |
gitRoot:Debian:12 |
before 1:2.39.5-0+deb12u3.root.io.9 | 1:2.39.5-0+deb12u3.root.io.91:2.39.5-0+deb12u3.aikido.10 |
rootio-gitRoot:Debian:12 |
before 1:2.39.5-0+deb12u3.root.io.9 | 1:2.39.5-0+deb12u3.root.io.91:2.39.5-0+deb12u3.aikido.10 |
gitUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1:2.5.0-11:2.6.2-11:2.6.3-11:2.6.4-11:2.7.0~rc3-1 Show 24 moreShow less1:2.7.0-11:2.7.3-0ubuntu11:2.7.4-0ubuntu11:2.7.4-0ubuntu1.11:2.7.4-0ubuntu1.21:2.7.4-0ubuntu1.31:2.7.4-0ubuntu1.41:2.7.4-0ubuntu1.51:2.7.4-0ubuntu1.61:2.7.4-0ubuntu1.71:2.7.4-0ubuntu1.81:2.7.4-0ubuntu1.91:2.7.4-0ubuntu1.101:2.7.4-0ubuntu1.10+esm11:2.7.4-0ubuntu1.10+esm31:2.7.4-0ubuntu1.10+esm41:2.7.4-0ubuntu1.10+esm51:2.7.4-0ubuntu1.10+esm61:2.7.4-0ubuntu1.10+esm71:2.7.4-0ubuntu1.10+esm81:2.7.4-0ubuntu1.10+esm91:2.7.4-0ubuntu1.10+esm101:2.7.4-0ubuntu1.10+esm111:2.7.4-0ubuntu1.10+esm13 |
None known |
gitUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1:2.14.1-1ubuntu41:2.15.1-1ubuntu21:2.17.0-1ubuntu11:2.17.1-1ubuntu0.11:2.17.1-1ubuntu0.3 Show 21 moreShow less1:2.17.1-1ubuntu0.41:2.17.1-1ubuntu0.51:2.17.1-1ubuntu0.61:2.17.1-1ubuntu0.71:2.17.1-1ubuntu0.81:2.17.1-1ubuntu0.91:2.17.1-1ubuntu0.101:2.17.1-1ubuntu0.111:2.17.1-1ubuntu0.121:2.17.1-1ubuntu0.131:2.17.1-1ubuntu0.141:2.17.1-1ubuntu0.151:2.17.1-1ubuntu0.161:2.17.1-1ubuntu0.171:2.17.1-1ubuntu0.181:2.17.1-1ubuntu0.18+esm11:2.17.1-1ubuntu0.18+esm21:2.17.1-1ubuntu0.18+esm31:2.17.1-1ubuntu0.18+esm41:2.17.1-1ubuntu0.18+esm61:2.17.1-1ubuntu0.18+esm8 |
None known |
gitUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1:2.20.1-2ubuntu11:2.24.0-1ubuntu11:2.24.0-1ubuntu21:2.25.0-1ubuntu11:2.25.1-1ubuntu1 Show 21 moreShow less1:2.25.1-1ubuntu21:2.25.1-1ubuntu31:2.25.1-1ubuntu3.11:2.25.1-1ubuntu3.21:2.25.1-1ubuntu3.31:2.25.1-1ubuntu3.41:2.25.1-1ubuntu3.51:2.25.1-1ubuntu3.61:2.25.1-1ubuntu3.71:2.25.1-1ubuntu3.81:2.25.1-1ubuntu3.101:2.25.1-1ubuntu3.111:2.25.1-1ubuntu3.121:2.25.1-1ubuntu3.131:2.25.1-1ubuntu3.141:2.25.1-1ubuntu3.14+esm11:2.25.1-1ubuntu3.14+esm21:2.25.1-1ubuntu3.14+esm31:2.25.1-1ubuntu3.14+esm41:2.25.1-1ubuntu3.14+esm51:2.25.1-1ubuntu3.14+esm6 |
None known |
gitUbuntu:22.04:LTS |
All versions, plus listed versions 1:2.32.0-1ubuntu11:2.33.1-1ubuntu11:2.34.1-1ubuntu11:2.34.1-1ubuntu1.11:2.34.1-1ubuntu1.2 Show 14 moreShow less1:2.34.1-1ubuntu1.41:2.34.1-1ubuntu1.51:2.34.1-1ubuntu1.61:2.34.1-1ubuntu1.81:2.34.1-1ubuntu1.91:2.34.1-1ubuntu1.101:2.34.1-1ubuntu1.111:2.34.1-1ubuntu1.121:2.34.1-1ubuntu1.131:2.34.1-1ubuntu1.141:2.34.1-1ubuntu1.151:2.34.1-1ubuntu1.161:2.34.1-1ubuntu1.171:2.34.1-1ubuntu1.18 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-24975 is a high vulnerability (CVSS 7.5) in Git-scm Git, published February 11, 2022. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 2.62%, the 85th percentile. Fixed in git 1:2.39.5-0+deb12u3.root.io.9.
References
wwws.nightwatchcybersecurity.com/2022/02/11/gitbleed
github.com/git/git/blob/2dc94da3744bfbbf145eca587a0f5ff480cc5867/Documentation/git-clone.txt
aquasec.com/blog/undetected-hard-code-secrets-expose-corporations
lore.kernel.org/git/xmqq4k14qe9g.fsf%40gitster.g
nvd.nist.gov/vuln/detail/CVE-2022-24975