CVE-2026-53585 in libgit2
Summary
by MITRE • 08/20/2026
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, git_delta_apply in src/libgit2/delta.c trusts the attacker-controlled res_sz value parsed by hdr_sz from a delta object header and passes that amount to git__malloc before validating delta instructions. Malicious pack data supplied through git_clone, git_fetch, git_remote_fetch, git_indexer_append, or a local attacker-supplied repository can use a very small multi-level OFS_DELTA chain to retain extremely large allocations and exhaust memory. This issue is fixed in versions 1.8.6 and 1.9.5.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified within libgit2 prior to versions 1.8.6 and 1.9.5 represents a critical heap-based resource exhaustion flaw rooted in improper validation of input data during the processing of Git delta objects. Libgit2 serves as a portable C implementation of core Git methods, providing developers with a linkable library to integrate version control functionality into custom applications. The specific defect resides within the git_delta_apply function located in src/libgit2/delta.c. This component is responsible for applying deltas, which are compact representations of file changes used by Git to optimize storage and transfer efficiency. In this context, the application parses a delta object header where it encounters two key values: hdr_sz, which indicates the size of the header itself, and res_sz, which specifies the expected result size or the amount of memory required for the reconstructed data. The core technical flaw is that libgit2 trusts the attacker-controlled res_sz value derived from hdr_sz without sufficient validation before proceeding with memory allocation operations.
The operational mechanism of this vulnerability allows a malicious actor to exploit the trust placed in these parsed values by supplying carefully crafted pack data through various entry points such as git_clone, git_fetch, git_remote_fetch, git_indexer_append, or even via a local attacker-supplied repository. By constructing a very small multi-level OFS_DELTA chain, an adversary can manipulate the parsing logic to retain extremely large allocation requests in memory while keeping the actual delta instructions minimal or misleading. This discrepancy between the allocated size and the validated instruction set leads to excessive memory consumption. The application attempts to allocate memory based on the unvalidated res_sz value via git__malloc before fully validating the subsequent delta instructions. Consequently, this results in a denial of service condition where the target system's available memory is exhausted, potentially causing the libgit2-based application or the underlying operating system to become unstable or crash due to out-of-memory errors.
From a classification perspective, this vulnerability aligns with CWE-400, which describes uncontrolled resource consumption, specifically manifesting as a denial of service through excessive allocation requests. It also relates to CWE-1321, involving improper verification of trust boundaries when parsing external data structures like Git pack files. In terms of the MITRE ATT&CK framework, this exploit technique falls under T1496, Resource Hijacking, where an attacker consumes significant computational resources such as memory or CPU cycles to disrupt service availability. The attack vector can be remote if triggered through network operations like fetching from a malicious repository, or local if the attacker has direct access to manipulate repository data on the host system.
The impact of this vulnerability is primarily focused on service availability and stability for applications relying on libgit2 for version control tasks. Systems processing untrusted Git repositories are at risk of experiencing severe performance degradation or complete failure when handling maliciously crafted delta objects. This can disrupt continuous integration pipelines, code review platforms, or any software that automates repository interactions using this library. To mitigate this risk, organizations must ensure that all instances of libgit2 are upgraded to version 1.8.6 or later for the stable branch and version 1.9.5 or later for the development branch. These releases contain patches that enforce stricter validation checks on delta object headers before memory allocation occurs, ensuring that res_sz values are consistent with actual data requirements and preventing the exploitation of this resource exhaustion flaw.