VulnerabilityModified
CVE-2016-8569
The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file.
MEDIUM 5.5EPSS 1.88%
Does this matter?
Lower severity and a low EPSS score (1.88%). Track it; it rarely justifies an emergency change on its own.
Description
The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file.
- CVSS 3.0
- 5.5 MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- EPSS
- 1.88% probability · 79th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-476
- Affected
- libgit2 project/libgit2 · fedoraproject/fedora · opensuse/leap · opensuse/opensuse · suse/linux enterprise
- Source
- cve@mitre.org
EPSS moved from 3.6% on 21 September 2026 to 1.9% on 27 October 2026.
References
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00075.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2017-01/msg00103.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2017-01/msg00110.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2017-01/msg00114.htmlThird Party Advisory
- http://www.openwall.com/lists/oss-security/2016/10/08/7Mailing List, Patch, Third Party Advisory
- http://www.securityfocus.com/bid/93465Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1383211Issue Tracking
- https://github.com/libgit2/libgit2/issues/3937Issue Tracking, Patch, Third Party Advisory
- https://github.com/libgit2/libgit2/releases/tag/v0.24.3Issue Tracking, Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4E77DG5KGQ7L34U75QY7O6NIPKZNQHQJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3JBSNJAXP7JA3TGE2NPNRTD77JXFG4E/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVUEIG6EESZB6BRU2IE3F5NRUEHMAEKC/
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00075.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2017-01/msg00103.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2017-01/msg00110.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2017-01/msg00114.htmlThird Party Advisory
- http://www.openwall.com/lists/oss-security/2016/10/08/7Mailing List, Patch, Third Party Advisory
- http://www.securityfocus.com/bid/93465Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1383211Issue Tracking
- https://github.com/libgit2/libgit2/issues/3937Issue Tracking, Patch, Third Party Advisory
- https://github.com/libgit2/libgit2/releases/tag/v0.24.3Issue Tracking, Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4E77DG5KGQ7L34U75QY7O6NIPKZNQHQJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3JBSNJAXP7JA3TGE2NPNRTD77JXFG4E/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVUEIG6EESZB6BRU2IE3F5NRUEHMAEKC/
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.