{"id":"CVE-2026-53584","aliases":["ALPINE-CVE-2026-53584","AZL-96974","BELL-CVE-2026-53584","DEBIAN-CVE-2026-53584","EUVD-2026-63546","GHSA-cw77-j82w-mchm","JLSEC-2026-1370","MGASA-2026-0570","RHSA-2026:59361","UBUNTU-CVE-2026-53584","openSUSE-SU-2026:11315-1"],"status":"published","title":"libgit2: Submodule path traversal","description":"libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00328,"percentile":0.26093,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-07-20T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"libgit2","fixed_in":["1.9.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libgit2","fixed_in":["1.9.6-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libgit2","fixed_in":["1.7.2-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libgit2","fixed_in":["1.9.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libgit2","fixed_in":["1.9.6-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libgit2","fixed_in":["1.5.1+ds-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libgit2","fixed_in":["1.9.0+ds-2+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libgit2","fixed_in":["1.9.6+ds-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibGit2_jll","fixed_in":["1.9.6+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libgit2","fixed_in":["0.28.4+dfsg.1-2ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libgit2","fixed_in":["1.1.0+dfsg.1-4.1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libgit2","fixed_in":["1.7.2+ds-1ubuntu3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libgit2","fixed_in":["1.9.1+ds-1ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.6-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.0-r2"},{"fixed":"1.9.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.1-r0"},{"fixed":"1.9.6-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1+ds-1+deb12u2"}]}],"versions":["1.5.1+ds-1","1.5.1+ds-1+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0+ds-2+deb13u1"}]}],"versions":["1.9.0+ds-2"]},{"source":"osv","ecosystem":"Debian:14","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.6+ds-1"}]}],"versions":["1.9.0+ds-2","1.9.1+ds-1","1.9.2+ds-1","1.9.2+ds-2","1.9.2+ds-3","1.9.2+ds-4","1.9.2+ds-5","1.9.2+ds-6","1.9.2+ds-7","1.9.2+ds-8","1.9.2+ds-9","1.9.3+ds-1","1.9.4+ds-1"]},{"source":"osv","ecosystem":"Julia","package":"LibGit2_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.9.6+0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-1.1.mga10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.7-1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libgit2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.7-1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0-2","0.19.0-2ubuntu0.4","0.19.0-2ubuntu0.4+esm1","0.19.0-2ubuntu0.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.22.2-2","0.23.1-1","0.24.1-2","0.24.1-2ubuntu0.2","0.24.1-2ubuntu0.2+esm1","0.24.1-2ubuntu0.2+esm2","0.24.1-2ubuntu0.2+esm3","0.24.1-2ubuntu0.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.25.1+really0.24.6-1","0.26.0+dfsg.1-1.1","0.26.0+dfsg.1-1.1build1","0.26.0+dfsg.1-1.1ubuntu0.2","0.26.0+dfsg.1-1.1ubuntu0.2+esm1","0.26.0+dfsg.1-1.1ubuntu0.2+esm2","0.26.0+dfsg.1-1.1ubuntu0.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.4+dfsg.1-2ubuntu0.1+esm1"}]}],"versions":["0.27.7+dfsg.1-0.2build1","0.28.3+dfsg.1-1","0.28.3+dfsg.1-1ubuntu1","0.28.4+dfsg.1-2","0.28.4+dfsg.1-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0+dfsg.1-4.1ubuntu0.1+esm1"}]}],"versions":["1.1.0+dfsg.1-4","1.1.0+dfsg.1-4.1","1.1.0+dfsg.1-4.1build1","1.1.0+dfsg.1-4.1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2+ds-1ubuntu3.1"}]}],"versions":["1.5.1+ds-1ubuntu1","1.7.1+ds-2ubuntu1","1.7.2+ds-1ubuntu1","1.7.2+ds-1ubuntu2","1.7.2+ds-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1+ds-1ubuntu1.1"}]}],"versions":["1.9.0+ds-2ubuntu2","1.9.1+ds-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.6-1.1"}]}],"bundled":5}],"products":[{"vendor":"libgit2","product":"libgit2"}],"references":[{"url":"https://github.com/libgit2/libgit2/security/advisories/GHSA-cw77-j82w-mchm","tags":["x_refsource_CONFIRM","advisory","web","article","report"]},{"url":"https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1","tags":["x_refsource_MISC","fix","web","article"]},{"url":"https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c","tags":["x_refsource_MISC","fix","web","article"]},{"url":"https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4","tags":["x_refsource_MISC","fix","web","article"]},{"url":"https://github.com/libgit2/libgit2/releases/tag/v1.8.6","tags":["x_refsource_MISC","web","article"]},{"url":"https://github.com/libgit2/libgit2/releases/tag/v1.9.5","tags":["x_refsource_MISC","web","article"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-53584","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53584","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-53584","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53584.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-53584","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0570.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35993","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/VHH635RSSSNGD55XOG7MSUBAC6CK77E2/","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/20/4","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8628-1","tags":["advisory"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00364.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59361","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53587","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53586","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53584","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53585","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53583","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59361.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520694","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53583","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53583","tags":["advisory"]},{"url":"https://github.com/libgit2/libgit2/commit/647dcb432980b84ede4cb5a008bbd1ccb4ead03d","tags":["article"]},{"url":"https://github.com/libgit2/libgit2/commit/c2aa35409ee0e6515df64da49750f13a0a42c47f","tags":["article"]},{"url":"https://github.com/libgit2/libgit2/commit/ef086bc3e4eedf62be38a910381aae24d49871ff","tags":["article"]},{"url":"https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520695","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53584","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520696","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53585","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53585","tags":["advisory"]},{"url":"https://github.com/libgit2/libgit2/commit/0cdfdd5fa8f8514c82413025e1e0808866cf7c30","tags":["article"]},{"url":"https://github.com/libgit2/libgit2/commit/c1896f06df22cc0ca5658df3a8f6cd7ede4cd6ae","tags":["article"]},{"url":"https://github.com/libgit2/libgit2/commit/dec22ac01ad9620c96b7b9ac3ef636ea46d43bed","tags":["article"]},{"url":"https://github.com/libgit2/libgit2/security/advisories/GHSA-27m5-gxxh-x79j","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520691","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53586","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53586","tags":["advisory"]},{"url":"https://github.com/libgit2/libgit2/commit/07de6a7e438f95ac9a6efd3222a82117e871ed27","tags":["article"]},{"url":"https://github.com/libgit2/libgit2/commit/af2b29ad0a74d5bac9751376879ddaf848136d3b","tags":["article"]},{"url":"https://github.com/libgit2/libgit2/commit/c1507abc44647b3acd832a33a5b1c8c9f5ba8821","tags":["article"]},{"url":"https://github.com/libgit2/libgit2/security/advisories/GHSA-2889-x8f6-mc4x","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520693","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53587","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53587","tags":["advisory"]},{"url":"https://github.com/libgit2/libgit2/commit/2c0ce8c0132ac38ab0db28239462a671e2e5440e","tags":["article"]},{"url":"https://github.com/libgit2/libgit2/commit/affda60c10fcef16723451c0d7dc71b71dc20ad3","tags":["article"]},{"url":"https://github.com/libgit2/libgit2/commit/d7a9fb87f504434e9f45228678953c4fa56e7640","tags":["article"]},{"url":"https://github.com/libgit2/libgit2/security/advisories/GHSA-pm24-4jhq-3xvm","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-53584","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53587","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-53584","title":"libgit2: Submodule path traversal","description":"libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.","status":"published","published":"2026-08-20T18:35:10.28Z","modified":"2026-08-20T19:48:17.848Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:19:59.761005Z"}],"euvd":[{"id":"EUVD-2026-63546","description":"libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.","status":"published","published":"2026-08-20T18:35:10Z","modified":"2026-08-20T19:48:17Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:38.846525Z"}],"nvd":[{"id":"CVE-2026-53584","description":"libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.","status":"published","published":"2026-08-20T19:16:54.68Z","modified":"2026-10-26T10:10:00.14Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:40.302911Z"}],"osv":[{"id":"ALPINE-CVE-2026-53584","description":"libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.","status":"published","published":"2026-08-20T19:16:54.68Z","modified":"2026-11-03T06:33:06.251338311Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"BELL-CVE-2026-53584","status":"published","published":"2026-07-23T10:20:03.7962Z","modified":"2026-08-22T07:15:08.794410741Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-53584","title":"libgit2: Submodule path traversal","description":"libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.","status":"published","published":"2026-08-20T18:35:10.28Z","modified":"2026-10-28T11:16:56.969486474Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:45:08.132336Z"},{"id":"DEBIAN-CVE-2026-53584","description":"libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.","status":"published","published":"2026-08-20T19:16:54.68Z","modified":"2026-10-27T09:47:43.901336817Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"JLSEC-2026-1370","description":"libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected `src/libgit2/submodule.c` paths include `git_submodule_lookup` and `git_submodule_add_setup`. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.","status":"published","published":"2026-08-21T21:14:18.508Z","modified":"2026-08-21T21:30:03.328517645Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"RHSA-2026:59361","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-25T10:23:28Z","modified":"2026-10-06T10:31:28.939470342Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"UBUNTU-CVE-2026-53584","description":"libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.","status":"published","published":"2026-07-31T00:00:00Z","modified":"2026-09-24T02:00:27.612231093Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"AZL-96974","title":"CVE-2026-53584 affecting package libgit2 for versions less than 1.7.2-3","description":"libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.","status":"published","published":"2026-08-20T19:16:54Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"MGASA-2026-0570","title":"Updated libgit2 package fixes security vulnerabilities","description":"Inverted IP SubjectAltName Comparison in OpenSSL Backend.\n(CVE-2026-53583)\nSubmodule path traversal. (CVE-2026-53584)\nUnbounded Memory Allocation via Delta Object Result-Size Header.\n(CVE-2026-53585)\nHTTP transport can leak credentials to an offsite redirect target.\n(CVE-2026-53586)\nUnauthenticated network-reachable heap out-of-bounds read in\ntransports/smart_pkt.c:set_data. (CVE-2026-53587)\nShell Command Injection via ssh_libssh2 Backend. (CVE-2026-5917)\n","status":"published","published":"2026-10-30T15:30:36Z","modified":"2026-10-30T15:45:02.524280865Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11315-1","title":"libgit2-1_9-1.9.6-1.1 on GA media","description":"These are all security issues fixed in the libgit2-1_9-1.9.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-20T00:00:00Z","modified":"2026-07-21T09:45:08.150224589Z","updated_at":"2026-11-02T16:58:38.95195Z"}]}}