RUSTSEC-2023-0003: git2 does not verify SSH keys by default

What to do

1. See which version you have: cargo tree -i libgit2-sys (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p libgit2-sys. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example libgit2-sys = "0.14.2") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

The git2 and libgit2-sys crates are Rust wrappers around the [libgit2]() C library. It was discovered that libgit2 1.5.0 and below did not verify SSH host keys when establishing an SSH connection, exposing users of the library to Man-In-the-Middle attacks.

The libgit2 team assigned CVE-2023-22742 to this vulnerability. The following versions of the libgit2-sys Rust crate have been released:

• libgit2-sys 0.14.2, updating the underlying libgit2 C library to version 1.5.1.
• libgit2-sys 0.13.5, updating the underlying libgit2 C library to version 1.4.5.

A new git2 crate version has also been released, 0.16.1. This version only bumps its libgit2-sys dependency to ensure no vulnerable libgit2-sys versions are used, but contains no code changes: if you update the libgit2-sys version there is no need to also update the git2 crate version.

You can learn more about this vulnerability in libgit2's advisory

References

• Package: crates.io/crates/libgit2-sys
• Advisory: rustsec.org/advisories/RUSTSEC-2023-0003.html
• Web: github.com/rust-lang/git2-rs/commit/87934f87d36753ed702792ec063be7246444a8e1

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for libgit2-sys

• Vulnerability HighRUSTSEC-2024-0013 · 2024-02-06Memory corruption, denial of service, and arbitrary code execution in libgit2

Full security history of libgit2-sys