libgit2 up to 1.8.5/1.9.4 Delta Application src/libgit2/delta.c git_delta_apply allocation of resources

Summaryinfo

A vulnerability classified as problematic was found in libgit2 up to 1.8.5/1.9.4. This issue affects the function git_delta_apply of the file src/libgit2/delta.c of the component Delta Application. Such manipulation leads to allocation of resources. This vulnerability is listed as CVE-2026-53585. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in libgit2 up to 1.8.5/1.9.4. It has been rated as problematic. Affected by this issue is the function git_delta_apply of the file src/libgit2/delta.c of the component Delta Application. The manipulation with an unknown input leads to a allocation of resources vulnerability. Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. Impacted is availability. CVE summarizes:

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, git_delta_apply in src/libgit2/delta.c trusts the attacker-controlled res_sz value parsed by hdr_sz from a delta object header and passes that amount to git__malloc before validating delta instructions. Malicious pack data supplied through git_clone, git_fetch, git_remote_fetch, git_indexer_append, or a local attacker-supplied repository can use a very small multi-level OFS_DELTA chain to retain extremely large allocations and exhaust memory. This issue is fixed in versions 1.8.6 and 1.9.5.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-53585 since 06/09/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 1.8.6 or 1.9.5 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• libgit2

Version

• 1.8.0
• 1.8.1
• 1.8.2
• 1.8.3
• 1.8.4
• 1.8.5
• 1.9.0
• 1.9.1
• 1.9.2
• 1.9.3
• 1.9.4

Website

• Product: https://github.com/libgit2/libgit2/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion