High
Security advisory
The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-10129
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:09 UTC · Revision 1
Source evidence
The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line.
osv:CVE-2016-10129
Complete source record
{
"id": "f113db141cfdc8ce216fb90d9680a077a0e8109eb0e117448fe5fa23cab22dc2",
"url": "https://osv.dev/vulnerability/CVE-2016-10129",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-10129",
"summary": "The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line.",
"evidence": "osv:CVE-2016-10129",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2016-10129",
"aliases": [
"CVE-2016-10129"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/libgit2/libgit2",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "428e18f8d4765b8ad6cf4022080a81ab16f6fdc4"
},
{
"introduced": "75db289a041b1f1084768244e167b953ac7eeaa5"
},
{
"last_affected": "a6763ff93aed9a1486c4f84d77151ff57dd4795e"
},
{
"fixed": "2fdef641fd0dd2828bd948234ae86de75221a11a"
},
{
"fixed": "84d30d569ada986f3eef527cbdb932643c2dd037"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:libgit2_project:libgit2:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "0.24.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:libgit2_project:libgit2:0.25.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.25.0"
},
{
"last_affected": "0.25.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:libgit2_project:libgit2:0.25.0:rc2:*:*:*:*:*:*",
"range": [
{
"introduced": "0.25.0-rc2"
},
{
"last_affected": "0.25.0-rc2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:libgit2_project:libgit2:0.25.0:rc1:*:*:*:*:*:*",
"range": [
{
"introduced": "0.25.0-rc1"
},
{
"last_affected": "0.25.0-rc1"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "2fdef641fd0dd2828bd948234ae86de75221a11a"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "84d30d569ada986f3eef527cbdb932643c2dd037"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"0.25.0",
"0.25.0-rc1",
"v0.25.0-rc2",
"v0.25.0",
"v0.24.5",
"v0.24.0",
"v0.24.3",
"v0.25.0-rc1",
"v0.24.2",
"v0.24.1",
"v0.24.0-rc1",
"v0.23.0",
"v0.23.0-rc2",
"v0.23.0-rc1",
"v0.22.0",
"v0.22.0-rc2",
"v0.22.0-rc1",
"v0.21.0",
"v0.18.0",
"v0.17.0",
"v0.16.0",
"v0.15.0",
"v0.14.0",
"v0.13.0",
"v0.12.0",
"v0.11.0",
"v0.10.0",
"v0.8.0",
"v0.3.0",
"v0.2.0",
"v0.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-10129.json",
"vanir_signatures": [
{
"id": "CVE-2016-10129-13623382",
"digest": {
"length": 1554,
"function_hash": "281870942429809697964233429407479786064"
},
"source": "https://github.com/libgit2/libgit2/commit/2fdef641fd0dd2828bd948234ae86de75221a11a",
"target": {
"file": "src/transports/smart_pkt.c",
"function": "git_pkt_parse_line"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-10129-195a9e9d",
"digest": {
"length": 767,
"function_hash": "11998386278566652511447441156810463108"
},
"source": "https://github.com/libgit2/libgit2/commit/84d30d569ada986f3eef527cbdb932643c2dd037",
"target": {
"file": "src/transports/smart_protocol.c",
"function": "add_push_report_sideband_pkt"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-10129-32280dec",
"digest": {
"threshold": 0.9,
"line_hashes": [
"152246948140881630936620450931454110309",
"16811967277530017021368320486600957734",
"292879344649057299944075837653643135603",
"298549967763928690655120293789489243655",
"1351908264529889708827696681179913415",
"209556476821616921868639732362087551565",
"4717289514444315326256119004573329260",
"31197857794155343171574802300529497082",
"49883739687684654055446185609463295700",
"209343592385465559184471154071075468438"
]
},
"source": "https://github.com/libgit2/libgit2/commit/84d30d569ada986f3eef527cbdb932643c2dd037",
"target": {
"file": "src/transports/smart_protocol.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-10129-3da35acb",
"digest": {
"length": 774,
"function_hash": "72184853542100227498318633168291035819"
},
"source": "https://github.com/libgit2/libgit2/commit/2fdef641fd0dd2828bd948234ae86de75221a11a",
"target": {
"file": "src/transports/smart_protocol.c",
"function": "add_push_report_sideband_pkt"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-10129-6b0895d6",
"digest": {
"length": 1554,
"function_hash": "281870942429809697964233429407479786064"
},
"source": "https://github.com/libgit2/libgit2/commit/84d30d569ada986f3eef527cbdb932643c2dd037",
"target": {
"file": "src/transports/smart_pkt.c",
"function": "git_pkt_parse_line"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-10129-74a8fb91",
"digest": {
"length": 1360,
"function_hash": "135059002852762528863613157248762657959"
},
"source": "https://github.com/libgit2/libgit2/commit/2fdef641fd0dd2828bd948234ae86de75221a11a",
"target": {
"file": "src/transports/smart_protocol.c",
"function": "parse_report"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-10129-915a9770",
"digest": {
"threshold": 0.9,
"line_hashes": [
"101839755603793106290328484701736422963",
"293975838795653773247296107534766666266",
"34812744770404104391051262345145744343",
"313420562608858859424183210121050054975",
"169105847764280994761539095595198651178",
"22445389468608118118616150183562509198",
"59273898729997772823423609055344856504"
]
},
"source": "https://github.com/libgit2/libgit2/commit/2fdef641fd0dd2828bd948234ae86de75221a11a",
"target": {
"file": "src/transports/smart_pkt.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-10129-9c8e013c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"152246948140881630936620450931454110309",
"16811967277530017021368320486600957734",
"292879344649057299944075837653643135603",
"298549967763928690655120293789489243655",
"1351908264529889708827696681179913415",
"209556476821616921868639732362087551565",
"4717289514444315326256119004573329260",
"31197857794155343171574802300529497082",
"49883739687684654055446185609463295700",
"209343592385465559184471154071075468438"
]
},
"source": "https://github.com/libgit2/libgit2/commit/2fdef641fd0dd2828bd948234ae86de75221a11a",
"target": {
"file": "src/transports/smart_protocol.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-10129-c97927a5",
"digest": {
"threshold": 0.9,
"line_hashes": [
"101839755603793106290328484701736422963",
"293975838795653773247296107534766666266",
"34812744770404104391051262345145744343",
"313420562608858859424183210121050054975",
"169105847764280994761539095595198651178",
"22445389468608118118616150183562509198",
"59273898729997772823423609055344856504"
]
},
"source": "https://github.com/libgit2/libgit2/commit/84d30d569ada986f3eef527cbdb932643c2dd037",
"target": {
"file": "src/transports/smart_pkt.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-10129-cd5e456d",
"digest": {
"length": 1360,
"function_hash": "135059002852762528863613157248762657959"
},
"source": "https://github.com/libgit2/libgit2/commit/84d30d569ada986f3eef527cbdb932643c2dd037",
"target": {
"file": "src/transports/smart_protocol.c",
"function": "parse_report"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:13:38Z"
}
}
],
"modified": "2026-10-20T13:13:38.092750193Z",
"provider": "osv",
"references": [
"https://github.com/libgit2/libgit2/commit/2fdef641fd0dd2828bd948234ae86de75221a11a",
"https://github.com/libgit2/libgit2/commit/84d30d569ada986f3eef527cbdb932643c2dd037",
"https://libgit2.github.com/security/"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2016-10129",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 387348,
"published_at": "2017-03-24T15:59:00.23+00:00"
}