CVE-2016-10130: The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allo...

Security readout for executives and security teams

CVE-2016-10130 affects older libgit2 versions used for Git operations. A flaw in HTTP connection error handling could let a man-in-the-middle attacker spoof a server. Business risk is highest where automated systems fetch code or dependencies over networks using vulnerable libgit2. Exposure is likely in systems or applications embedding vulnerable libgit2 releases, especially CI, developer workstations, package tooling, or services performing Git HTTP operations. The source bundle does not list specific downstream products beyond libgit2 and openSUSE package advisories. Treat as a targeted remediation item for development and build infrastructure. It is not KEV-listed in the provided sources, but server spoofing in code retrieval paths can affect supply-chain trust if vulnerable libgit2 is still deployed. Mitigation focus: Upgrade libgit2 to 0.24.6, 0.25.1, or a later fixed release.; Apply relevant vendor OS package updates where libgit2 is distro-managed.; Inventory applications that statically or dynamically embed libgit2..

Prepared

Jun 13, 2026, 05:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.