Vulnerability HighRUSTSEC-2024-0013 · libgit2-sys
RUSTSEC-2024-0013: Memory corruption, denial of service, and arbitrary code execution in libgit2
Short answerA security vulnerability in the libgit2-sys crate: Memory corruption, denial of service, and arbitrary code execution in libgit2. High severity (CVSS 8.6). Fixed in 0.16.2: update to a fixed version.
| Crate | libgit2-sys |
|---|---|
| Type | Vulnerability (denial-of-service, code-execution, memory-corruption) |
| Affected versions | Before 0.16.2. |
| Fixed in | 0.16.2 |
| Severity | High, CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L |
| Published | 2024-02-06 |
| Last changed | 2026-02-04 |
| Also known as | GHSA-22q8-ghmq-63vf |
| Affected functions | libgit2_sys::git_index_add, libgit2_sys::git_revparse_single |
What to do
- See which version you have:
cargo tree -i libgit2-sys(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p libgit2-sys. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplelibgit2-sys = "0.16.2") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
The libgit2 project fixed three security issues in the 1.7.2 release. These issues are:
- The
git_revparse_singlefunction can potentially enter an infinite loop on a well-crafted input, potentially causing a Denial of Service. This function is exposed in thegit2crate via theRepository::revparse_singlemethod. - The
git_index_addfunction may cause heap corruption and possibly lead to arbitrary code execution. This function is exposed in thegit2crate via theIndex::addmethod. - The smart transport negotiation may experience an out-of-bounds read when a remote server did not advertise capabilities.
The libgit2-sys crate bundles libgit2, or optionally links to a system libgit2 library. In either case, versions of the libgit2 library less than 1.7.2 are vulnerable. The 0.16.2 release of libgit2-sys bundles the fixed version of 1.7.2, and requires a system libgit2 version of at least 1.7.2.
It is recommended that all users upgrade.
References
- Package: crates.io/crates/libgit2-sys
- Advisory: rustsec.org/advisories/RUSTSEC-2024-0013.html
- Web: github.com/rust-lang/git2-rs/pull/1017
- Web: github.com/libgit2/libgit2/releases/tag/v1.7.2
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for libgit2-sys
Up next
Same cratelibgit2-sys: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?