Memory Exhaustion Vulnerability in libgit2 Used by Git Applications
CVE-2026-53585
5.3MEDIUM
What is CVE-2026-53585?
libgit2, a portable C implementation of the core Git methods, has a vulnerability that allows for memory exhaustion through unvalidated allocations. Specifically, the function git_delta_apply in version prior to 1.8.6 and 1.9.5 accepts an attacker-controlled size parameter without proper validation. This flaw can be exploited using malicious pack data via operations such as git_clone, git_fetch, or a local attacker-supplied repository. By employing a small multi-level OFS_DELTA chain, attackers could potentially retain significantly large memory allocations, leading to exhaustion of system resources. The issue has been addressed in libgit2 versions 1.8.6 and 1.9.5.
Affected Version(s)
libgit2 < 1.8.6 < 1.8.6
libgit2 >= 1.9.0, < 1.9.5 < 1.9.0, 1.9.5