RUSTSEC-2026-0184
Potential undefined behavior with Signature from a buffer-created BlameHunk
When a Blame is created via Blame::blame_buffer(), and a BlameHunk is retrieved, the pointers to the original author, original committer, final author, and final committer may be null if unavailable. The corresponding BlameHunk methods then create Signatures based on null pointers; attempting to access the data of the Signatures leads to dereferencing null pointers.
What each source reports
OSV No score
Potential undefined behavior with Signature from a buffer-created BlameHunk
When a Blame is created via Blame::blame_buffer(), and a BlameHunk is retrieved, the pointers to the original author, original committer, final author, and final committer may be null if unavailable. The corresponding BlameHunk methods then create Signatures based on null pointers; attempting to access the data of the Signatures leads to dereferencing null pointers.
- Record
RUSTSEC-2026-0184- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
git2crates.io |
0.0.0-0 up to 0.21.0 | 0.21.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0184 is a vulnerability with no CVSS score yet in git2, published May 13, 2026. No source lists public exploit code. Fixed in git2 0.21.0.