Libgit2 is a widely embedded, lightweight C library implementing Git version-control functionality across a large range of applications and platforms, from web services to IDEs to deployment tooling. Its vulnerabilities skew strongly toward critical-severity outcomes and frequently acquire public exploit code, reflecting both the memory-safety demands of a C codebase operating on untrusted repository data and the high-value nature of Git handling in supply-chain and access-control contexts. The recurring weakness classes—out-of-bounds reads, improper input validation, integer overflows, name-resolution issues, and double-free conditions—characterize the parsing and pointer-management challenges intrinsic to a low-level Git implementation. Defenders should prioritize patching this library in embedded contexts where version tracking is not easily visible; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Libgit2 over time
Signals from CVEs in this vendor scope (16 CVEs).
16 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2014-9390CRITICAL Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode | Feb 12, 2020 | 9.8 | 76 | NO | YES |
CVE-2020-12279CRITICAL An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote co | Apr 27, 2020 | 9.8 | 32 | NO | NO |
CVE-2016-10128CRITICAL Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attac | Mar 24, 2017 | 9.8 | 31 | NO | NO |
CVE-2024-24577CRITICAL libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using wel | Feb 6, 2024 | 9.8 | 28 | NO | NO |
CVE-2020-12278CRITICAL An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow re | Apr 27, 2020 | 9.8 | 27 | NO | NO |
CVE-2018-15501HIGH In ng_pkt in transports/smart_pkt.c in libgit2 before 0.26.6 and 0.27.x before 0.27.4, a remote attacker can send a crafted smart-protocol "ng" packet that lacks a '\0' byte to tri | Aug 18, 2018 | 7.5 | 27 | NO | NO |
CVE-2018-10887HIGH A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overf | Jul 10, 2018 | 8.1 | 25 | NO | NO |
CVE-2016-10129HIGH The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet | Mar 24, 2017 | 7.5 | 25 | NO | NO |
CVE-2018-8099MEDIUM Incorrect returning of an error code in the index.c:read_entry() function leads to a double free in libgit2 before v0.26.2, which allows an attacker to cause a denial of service vi | Mar 14, 2018 | 6.5 | 23 | NO | NO |
CVE-2024-24575HIGH libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using wel | Feb 6, 2024 | 7.5 | 22 | NO | NO |
Signals from CVEs in this vendor scope (16 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Libgit2.
Media articles that mention a CVE ID that affects a product developed by Libgit2 — matched by CVE ID, not by vendor name.