CVE-2025-66413

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-66413
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66413.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-66413
Aliases
  • GHSA-hv9c-4jm9-jh3x
Downstream
Published
2026-03-10T20:34:32.769Z
Modified
2026-08-12T03:51:25.379320087Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CVSS Calculator
Summary
Git for Windows leaks NTLM hash when cloning from an attacker-controlled server
Details

Git for Windows is the Windows port of Git. Prior to 2.53.0(2), it is possible to obtain a user's NTLM hash by tricking them into cloning from a malicious server. Since NTLM hashing is weak, it is possible for the attacker to brute-force the user's account name and password. This vulnerability is fixed in 2.53.0(2).

Database specific 
{
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66413.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/git-for-windows/git

Affected ranges

Type
GIT
Repo
https://github.com/git-for-windows/git
Events
Introduced
e9edee0b34751bf4d7d1feda0e2535bff64d4e77
Fixed
e9edee0b34751bf4d7d1feda0e2535bff64d4e77
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "< 2.53.0(2)"
        },
        {
            "last_affected": "< 2.53.0(2)"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

< 2.*
< 2.53.0(2)

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66413.json"