CVE-2018-8099: Debian Linux

Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days.

Incorrect returning of an error code in the index.c:read_entry() function leads to a double free in libgit2 before v0.26.2, which allows an attacker to cause a denial of service via a crafted repository index file.

Affected products

• Debian Debian Linux: version 9.0 only
• LIBGIT2 LIBGIT2: before 0.26.2 (fixed in 0.26.2)

Published 2018-03-14. Last modified 2026-06-17.