Memory Corruption, Denial of Service, and Arbitrary Code Execution in libgit2-sys
Summary
GHSA-22q8-ghmq-63vf: libgit2-sys affected by memory corruption, denial of service, and arbitrary code execution in libgit2. Affects libgit2-sys versions < 0.16.2. Fixed in 0.16.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libgit2-sys is a crate that bundles libgit2, or optionally links to a system libgit2 library. It provides functionality for interacting with Git repositories. The libgit2 library, versions prior to 1.7.2, is vulnerable to memory corruption, denial of service, and arbitrary code execution.
Vulnerability Detail
The libgit2-sys crate, specifically the functions git_index_add and git_revparse_single, is affected by memory corruption and denial of service vulnerabilities. The git_index_add function can cause heap corruption, potentially leading to arbitrary code execution. The git_revparse_single function can enter an infinite loop on certain inputs, resulting in a denial of service. Additionally, the smart transport negotiation may experience an out-of-bounds read when a remote server does not advertise capabilities. These vulnerabilities can be exploited by an attacker to crash the application, execute arbitrary code, or cause other malicious impacts.
How To Fix
Latest published version: 0.10.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.16.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities.
Conclusion
The libgit2-sys crate is vulnerable to memory corruption, denial of service, and arbitrary code execution due to issues in the underlying libgit2 library. It is crucial to upgrade to the fixed version (0.16.2) of the crate or ensure the system libgit2 library is at least version 1.7.2 to mitigate these vulnerabilities. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for libgit2-sys →
FAQ
libgit2-sys is a crate that provides bindings to the libgit2 library, allowing developers to interact with Git repositories in Rust.
Versions of the libgit2 library prior to 1.7.2 are vulnerable.
An attacker can exploit these vulnerabilities by providing specially crafted inputs to the affected functions, leading to memory corruption, denial of service, or arbitrary code execution.
No, there are no known workarounds for these vulnerabilities.
To fix the vulnerabilities, upgrade to version 0.16.2 of the libgit2-sys crate, which includes the fixed version of the libgit2 library (1.7.2).
References
Related vulnerabilities
Recent vulnerabilities recorded for libgit2-sys.
