libgit2 Files

v1.8.6

🔒 This is a security release with multiple changes.

• Fix for blame error handling on hunk creation failures

hunk_from_entry can return NULL on error; handle that and return an error.

• Fix for potential PCRE memory access: 1-byte heap-buffer-overflow WRITE in bundled PCRE 8.45 reachable via revspec

git_revparse_single accepts revspecs of the form :/<pattern> (the "grep by commit message" shorthand) and forwards <pattern> directly to libgit2's regex backend. When libgit2 is using its builtin regular expression engine, this causes a heap buffer overflow.

This vulnerability was identified by @DavidKorczynski.

• Fix for CVE-2026-53586: give auth callback current host

libgit2's builtin HTTP transport follows offsite redirects for the initial smart HTTP request by default. If the redirected server then returns 401 Unauthorized, libgit2 asks the application credential callback for credentials using the original remote URL, not the redirected URL. The returned credential is then attached to the next request to the redirected host as an Authorization header.

This vulnerability was identified by @sondt99, and CVE-2026-53586 was issued for this vulnerability.

• Fix for CVE-2026-53587: libgit2 version 1.9.4 and below is vulnerable to a heap out-of-bounds read in set_data in src/libgit2/transports/smart_pkt.c.

When given capabilities, we check for the object-format capability; we need to ensure that the current packet buffer is large enough before actually doing the check.

This vulnerability was identified by @manop55555, and CVE-2026-53587 was issued for this vulnerability.

• Fix for CVE-2026-53585: Unbounded Memory Allocation via Delta Object Result-Size Header

Potential denial of service because git_delta_apply reads the claimed result size (res_sz) from the delta object header — data entirely controlled by the sender — and immediately allocates a buffer of that size.

This vulnerability was identified by Michał Majchrowicz and Marcin Wyczechowski, members of the AFINE Team, and CVE-2026-53585 was issued for this vulnerability.

• Fix for CVE-2026-53584: submodule: check paths for escaping

A crafted repository with a submodule whose path contains traversal components (e.g. "../") can cause the library to create directories outside the repository's working tree.

This vulnerability was identified by @sectroyer, and CVE-2026-53584 was issued for this vulnerability.

• Fix for CVE-2026-53583: inverted IP SubjectAltName comparison in OpenSSL backend.

An inverted comparison in the OpenSSL TLS backend causes IP SubjectAltName (SAN) verification to accept certificates with mismatched IP addresses and reject certificates with correct IP addresses. This allows a network attacker with a valid CA-signed certificate containing any IP SAN to perform MITM attacks against libgit2 clients connecting to IP-literal HTTPS URLs.

This vulnerability was identified by @pavelkohout396, and CVE-2026-53583 was issued for this vulnerability.

All users of the v1.8 release line are recommended to upgrade.

libgit2 thanks the reporters of these issues for their responsible disclosure.

Full Changelog: https://github.com/libgit2/libgit2/compare/v1.8.5...v1.8.6