{
  "cveId": "CVE-2026-53586",
  "url": "https://patchblox.com/security/cve/CVE-2026-53586",
  "summary": "CVE-2026-53586 is fixed in 30 products on 1 platform, first by libgit2-1.9 1.9.1\u002Bds-1ubuntu1.1, released July 30, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "libgit2: libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allow...",
  "description": "libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in HTTP transport in src/libgit2/transports/http.c follows an offsite initial redirect, and handle_remote_auth and handle_auth pass transport-\u003Eowner-\u003Eurl instead of transport-\u003Eserver.url to the credential callback when the redirected host returns 401 Unauthorized. A callback that scopes credentials to the original trusted URL can therefore return GIT_CREDENTIAL_USERPASS_PLAINTEXT credentials that libgit2 stores in transport-\u003Eserver.cred and sends as an Authorization header to the redirected host. An attacker who controls a trusted Git host or an open redirect on that host can disclose HTTP Basic credentials, personal access tokens, or equivalent credentials. This issue is fixed in versions 1.8.6 and 1.9.5.",
  "published": "2026-07-30T17:00:00Z",
  "severity": "medium",
  "cvss": 6.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
  "epss": 0.00276,
  "epssPercentile": 0.2017,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "cargo",
      "release": "amzn 2023",
      "fixedVersion": "1.97.0-2.amzn2023",
      "fix": "ALAS2023-2026-2065",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2065",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "cargo-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.97.0-2.amzn2023",
      "fix": "ALAS2023-2026-2065",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2065",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "clippy",
      "release": "amzn 2023",
      "fixedVersion": "1.97.0-2.amzn2023",
      "fix": "ALAS2023-2026-2065",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2065",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "clippy-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.97.0-2.amzn2023",
      "fix": "ALAS2023-2026-2065",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2065",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libgit2",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "1.5.1\u002Bds-1\u002Bdeb12u2",
      "fix": "DEBIAN-CVE-2026-53586",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-53586",
      "released": "2026-07-31T14:18:19Z"
    },
    {
      "platform": "linux",
      "product": "libgit2",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1.9.0\u002Bds-2\u002Bdeb13u1",
      "fix": "DEBIAN-CVE-2026-53586",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-53586",
      "released": "2026-07-31T14:18:19Z"
    },
    {
      "platform": "linux",
      "product": "libgit2",
      "release": "Debian 14",
      "fixedVersion": "1.9.6\u002Bds-1",
      "fix": "DEBIAN-CVE-2026-53586",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-53586",
      "released": "2026-07-31T14:18:19Z"
    },
    {
      "platform": "linux",
      "product": "libgit2",
      "release": "amzn 2023",
      "fixedVersion": "1.6.4-116.amzn2023",
      "fix": "ALAS2023-2026-2083",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2083",
      "released": "2026-08-31T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libgit2-1.1",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1.1.0\u002Bdfsg.1-4.1ubuntu0.1\u002Besm1",
      "fix": "libgit2-1.1 1.1.0\u002Bdfsg.1-4.1ubuntu0.1\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-libgit2-1.1-1.1.0-dfsg.1-4.1ubuntu0.1-esm1",
      "released": "2026-08-14T22:30:01Z"
    },
    {
      "platform": "linux",
      "product": "libgit2-1.7",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.7.2\u002Bds-1ubuntu3.1",
      "fix": "libgit2-1.7 1.7.2\u002Bds-1ubuntu3.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-libgit2-1.7-1.7.2-ds-1ubuntu3.1",
      "released": "2026-08-14T22:30:01Z"
    },
    {
      "platform": "linux",
      "product": "libgit2-1.9",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "1.9.1\u002Bds-1ubuntu1.1",
      "fix": "libgit2-1.9 1.9.1\u002Bds-1ubuntu1.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-libgit2-1.9-1.9.1-ds-1ubuntu1.1",
      "released": "2026-07-30T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libgit2-28",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "0.28.4\u002Bdfsg.1-2ubuntu0.1\u002Besm1",
      "fix": "libgit2-28 0.28.4\u002Bdfsg.1-2ubuntu0.1\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-libgit2-28-0.28.4-dfsg.1-2ubuntu0.1-esm1",
      "released": "2026-08-14T22:29:56Z"
    },
    {
      "platform": "linux",
      "product": "libgit2-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.6.4-116.amzn2023",
      "fix": "ALAS2023-2026-2083",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2083",
      "released": "2026-08-31T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libgit2-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "1.6.4-116.amzn2023",
      "fix": "ALAS2023-2026-2083",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2083",
      "released": "2026-08-31T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libgit2-devel",
      "release": "amzn 2023",
      "fixedVersion": "1.6.4-116.amzn2023",
      "fix": "ALAS2023-2026-2083",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2083",
      "released": "2026-08-31T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libgit2-fixtures",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1.1.0\u002Bdfsg.1-4.1ubuntu0.1\u002Besm1",
      "fix": "libgit2-fixtures 1.1.0\u002Bdfsg.1-4.1ubuntu0.1\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-libgit2-fixtures-1.1.0-dfsg.1-4.1ubuntu0.1-esm1",
      "released": "2026-08-14T22:30:01Z"
    },
    {
      "platform": "linux",
      "product": "libgit2-fixtures",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.7.2\u002Bds-1ubuntu3.1",
      "fix": "libgit2-fixtures 1.7.2\u002Bds-1ubuntu3.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-libgit2-fixtures-1.7.2-ds-1ubuntu3.1",
      "released": "2026-08-14T22:30:01Z"
    },
    {
      "platform": "linux",
      "product": "libgit2-fixtures",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "1.9.1\u002Bds-1ubuntu1.1",
      "fix": "libgit2-fixtures 1.9.1\u002Bds-1ubuntu1.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-libgit2-fixtures-1.9.1-ds-1ubuntu1.1",
      "released": "2026-07-30T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rust",
      "release": "amzn 2023",
      "fixedVersion": "1.97.0-2.amzn2023",
      "fix": "ALAS2023-2026-2065",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2065",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rust-analyzer",
      "release": "amzn 2023",
      "fixedVersion": "1.97.0-2.amzn2023",
      "fix": "ALAS2023-2026-2065",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2065",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rust-analyzer-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.97.0-2.amzn2023",
      "fix": "ALAS2023-2026-2065",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2065",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rust-debugger-common",
      "release": "amzn 2023",
      "fixedVersion": "1.97.0-2.amzn2023",
      "fix": "ALAS2023-2026-2065",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2065",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rust-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.97.0-2.amzn2023",
      "fix": "ALAS2023-2026-2065",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2065",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rust-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "1.97.0-2.amzn2023",
      "fix": "ALAS2023-2026-2065",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2065",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rust-doc",
      "release": "amzn 2023",
      "fixedVersion": "1.97.0-2.amzn2023",
      "fix": "ALAS2023-2026-2065",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2065",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rust-gdb",
      "release": "amzn 2023",
      "fixedVersion": "1.97.0-2.amzn2023",
      "fix": "ALAS2023-2026-2065",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2065",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rust-lldb",
      "release": "amzn 2023",
      "fixedVersion": "1.97.0-2.amzn2023",
      "fix": "ALAS2023-2026-2065",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2065",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rust-src",
      "release": "amzn 2023",
      "fixedVersion": "1.97.0-2.amzn2023",
      "fix": "ALAS2023-2026-2065",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2065",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rust-std-static",
      "release": "amzn 2023",
      "fixedVersion": "1.97.0-2.amzn2023",
      "fix": "ALAS2023-2026-2065",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2065",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rust-std-static-wasm32-unknown-unknown",
      "release": "amzn 2023",
      "fixedVersion": "1.97.0-2.amzn2023",
      "fix": "ALAS2023-2026-2065",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2065",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rust-std-static-wasm32-wasip1",
      "release": "amzn 2023",
      "fixedVersion": "1.97.0-2.amzn2023",
      "fix": "ALAS2023-2026-2065",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2065",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rust-toolset",
      "release": "amzn 2023",
      "fixedVersion": "1.97.0-2.amzn2023",
      "fix": "ALAS2023-2026-2065",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2065",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rust-toolset-srpm-macros",
      "release": "amzn 2023",
      "fixedVersion": "1.97.0-2.amzn2023",
      "fix": "ALAS2023-2026-2065",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2065",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rustfmt",
      "release": "amzn 2023",
      "fixedVersion": "1.97.0-2.amzn2023",
      "fix": "ALAS2023-2026-2065",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2065",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rustfmt-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.97.0-2.amzn2023",
      "fix": "ALAS2023-2026-2065",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2065",
      "released": "2026-08-17T09:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}