CVE-2025-66413

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-66413
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66413.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-66413
Aliases
  • GHSA-hv9c-4jm9-jh3x
Downstream
Published
2026-03-10T20:34:32Z
Modified
2026-10-28T02:30:24Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CVSS Calculator
Summary
Git for Windows leaks NTLM hash when cloning from an attacker-controlled server
Details

Git for Windows is the Windows port of Git. Prior to 2.53.0(2), it is possible to obtain a user's NTLM hash by tricking them into cloning from a malicious server. Since NTLM hashing is weak, it is possible for the attacker to brute-force the user's account name and password. This vulnerability is fixed in 2.53.0(2).

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66413.json"
}
References

Affected packages

Git / github.com/git-for-windows/git

Affected ranges

Type
GIT
Repo
https://github.com/git-for-windows/git
Events
Introduced
e9edee0b34751bf4d7d1feda0e2535bff64d4e77
Fixed
e9edee0b34751bf4d7d1feda0e2535bff64d4e77
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "< 2.53.0(2)"
                },
                {
                    "last_affected": "< 2.53.0(2)"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "original_tag": "v2.53.0.windows.2",
            "range": [
                {
                    "fixed": "e9edee0b34751bf4d7d1feda0e2535bff64d4e77"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

< 2.*
< 2.53.0(2)

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66413.json"