{"id":"GHSA-j39j-6gw9-jw6h","aliases":["RUSTSEC-2026-0008"],"url":"https://o3.security/vulnerability/GHSA-j39j-6gw9-jw6h","summary":"git2 has potential undefined behavior when dereferencing Buf struct ","details":"If the Buf struct is dereferenced immediately after calling new() or default() on the Buf struct, a null pointer is passed to the unsafe function slice::from_raw_parts. According to the safety section documentation of the function, data must be non-null and aligned even for zero-length slices or slices of ZSTs. Thus, passing a null pointer will lead to undefined behavior.","published":"2026-02-04T20:36:04Z","modified":"2026-09-10T03:50:35.308686138Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"git2","fixedVersion":"0.20.4"}],"fix":{"url":"https://github.com/rust-lang/git2-rs/pull/1213","label":"rust-lang/git2-rs#1213"},"references":[{"type":"WEB","url":"https://github.com/rust-lang/git2-rs/issues/1211"},{"type":"WEB","url":"https://github.com/rust-lang/git2-rs/pull/1213"},{"type":"WEB","url":"https://github.com/rust-lang/git2-rs/commit/9e160f15bd056f82143109bb330573381e5de719"},{"type":"PACKAGE","url":"https://github.com/rust-lang/git2-rs"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2026-0008.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-10T03:50:35.308686138Z"}}