CVE-2012-4465: Heap-based buffer overflow in the substr function in parsing.c in cgit 0.9.0.3 and earlier allows remote au...

Security readout for executives and security teams

CVE-2012-4465 is a memory corruption flaw in older cgit versions. A specially formed commit with an empty Author username can crash the cgit service and may allow code execution. Business urgency depends on whether the organization still runs cgit 0.9.0.3 or earlier and accepts commits from authenticated users. Exposure is most likely where cgit 0.9.0.3 or earlier is deployed to render repositories containing commits from authenticated users. Publicly reachable cgit instances raise operational impact, but the source bundle does not prove unauthenticated exploitation. Prioritize remediation if cgit is still used, especially on public or shared repository viewers. The flaw is old but serious because memory corruption can disrupt service and may cross into code execution. If cgit is not present, no action is needed beyond asset confirmation. Mitigation focus: Identify any cgit deployments and record their exact versions.; Upgrade cgit beyond 0.9.0.3 or apply the referenced upstream fix.; Check operating system vendor advisories for packaged backports..

Prepared

Jun 27, 2026, 16:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.