CVE-2026-53585: libgit2: Unbounded Memory Allocation via Delta Object Result-Size Header
Last updated 13 August 2026
Other sources
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, gitdeltaapply in src/libgit2/delta.c trusts the attacker-controlled ressz value parsed by hdrsz from a delta object header and passes that amount to gitmalloc before validating delta instructions. Malicious pack data supplied through gitclone, gitfetch, gitremotefetch, gitindexerappend, or a local attacker-supplied repository can use a very small multi-level OFSDELTA chain to retain extremely large allocations and exhaust memory. This issue is fixed in versions 1.8.6 and 1.9.5.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libgit2to a version that resolves this vulnerability.Fixed in 1.9.6+ds-1 - Upgrade
Upgrade
libgit2to a version that resolves this vulnerability.Fixed in 1.8.6 - Upgrade
Upgrade
libgit2to a version that resolves this vulnerability.Fixed in 1.9.5
Event History
Frequently Asked Questions
Which application workflows can expose a deployment to malicious pack data?
The vulnerable code can be reached through git_clone, git_fetch, git_remote_fetch, and git_indexer_append. A locally attacker-supplied repository can also trigger the issue.
Does exploitation require authentication or user interaction?
The supplied severity vector indicates network access, low attack complexity, no privileges required, and no user interaction. Exploitation relies on providing malicious pack data containing a small multi-level OFS_DELTA chain.
What is the practical impact?
A malicious delta header can cause extremely large memory allocations before delta instructions are validated. Retaining these allocations can exhaust memory and cause a denial of service.
What versions contain the fix?
The issue is fixed in libgit2 versions 1.8.6 and 1.9.5. Versions prior to those releases are described as affected.