CVE-2016-1901: Cgit Project Cgit

Critical severity, CVSS 9.8. EPSS: 3.8% chance of exploitation in the next 30 days.

Integer overflow in the authenticate_post function in CGit before 0.12 allows remote attackers to have unspecified impact via a large value in the Content-Length HTTP header, which triggers a buffer overflow.

Affected products

• Cgit Project Cgit: up to and including 0.11.2
• Fedoraproject Fedora: version 22 only

Published 2016-01-20. Last modified 2026-06-17.