CVE-2014-9390: JGit Improper Input Validation vulnerability
Summary
CVE-2014-9390: JGit Improper Input Validation vulnerability. Affects org.eclipse.jgit:org.eclipse.jgit versions < 3.5.3. Fixed in 3.5.3. How to fix ↓
Also tracked for
The same CVE-2014-9390 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JGit is an open-source Java library that provides Git version control functionality. It is commonly used in software development to manage source code repositories. JGit allows developers to interact with Git repositories programmatically, enabling operations such as cloning, committing, and merging. However, a vulnerability has been discovered in JGit that could potentially allow remote Git servers to execute arbitrary commands on the client's system.
Vulnerability Detail
The vulnerability, identified as CVE-2014-9390, arises from improper input validation in JGit. Specifically, versions of JGit before 3.5.3 are affected. When a Git repository contains a crafted .git/config file with certain characteristics, such as an ignorable Unicode codepoint, a git~1/config representation, or mixed case on a case-insensitive filesystem, the vulnerability can be triggered. Exploiting this vulnerability, a malicious Git server can execute arbitrary commands on the client's system, potentially leading to unauthorized access, data manipulation, or other malicious activities.
How To Fix
Latest published version: 7.8.0.202609011348-r as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.5.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can manually validate and sanitize the input received from Git repositories before processing it with JGit. This involves implementing strict input validation checks and ensuring that any potentially dangerous characters or sequences are properly handled or rejected. However, applying the official fix by updating JGit to the latest version is the recommended approach.
Conclusion
The JGit Improper Input Validation vulnerability (CVE-2014-9390) poses a significant risk to systems utilizing affected versions of JGit. To mitigate this vulnerability, it is crucial to update JGit to version 3.5.3 or later. Developers should also ensure proper input validation and sanitization when processing data from Git repositories. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.eclipse.jgit:org.eclipse.jgit →
FAQ
JGit is an open-source Java library that provides Git version control functionality. It allows developers to interact with Git repositories programmatically.
The vulnerability in JGit could allow remote Git servers to execute arbitrary commands on the client's system, potentially leading to unauthorized access or data manipulation.
Versions of JGit before 3.5.3 are affected by this vulnerability.
To fix this vulnerability, update JGit to version 3.5.3 or later.
A workaround involves manually validating and sanitizing input from Git repositories before processing it with JGit. However, updating JGit to the latest version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jgit:org.eclipse.jgit.
