JLSEC-2025-186

See a problem?
Please try reporting it to the source first.
Source
https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2025/JLSEC-2025-186.md
Import Source
https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2025/JLSEC-2025-186.json
JSON Data
https://api.osv.dev/v1/vulns/JLSEC-2025-186
Upstream
Published
2025-10-21T19:17:09.363Z
Modified
2025-11-06T23:03:29.857666Z
Summary
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a...
Details

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to git_index_add can cause heap corruption that could be leveraged for arbitrary code execution. There is an issue in the has_dir_name function in src/libgit2/index.c, which frees an entry that should not be freed. The freed entry is later used and overwritten with potentially bad actor-controlled data leading to controlled heap corruption. Depending on the application that uses libgit2, this could lead to arbitrary code execution. This issue has been patched in version 1.6.5 and 1.7.2.

Database specific 
{
    "license": "CC-BY-4.0",
    "sources": [
        {
            "published": "2024-02-06T22:16:15.270Z",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-24577",
            "modified": "2024-11-21T08:59:27.603Z",
            "imported": "2025-10-21T17:12:53.564Z",
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24577",
            "id": "CVE-2024-24577"
        }
    ]
}
References

Affected packages

Julia / LibGit2_jll

Package

Name
LibGit2_jll
Purl
pkg:julia/LibGit2_jll?uuid=e37daf67-58a4-590a-8e99-b0245dd2ffc5

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.7.2+0