Loading vulnerability…
Unbounded Memory Allocation in libgit2 Delta Processing
CVE-2026-53585 is an unbounded memory allocation vulnerability in libgit2, fixed in versions 1.8.6 and 1.9.5. The git_delta_apply function trusts the attacker-controlled result size, res_sz, parsed by hdr_sz from a delta object header and passes it to git__malloc before validating the delta instructions. A small malicious pack containing a multi-level OFS_DELTA chain can retain extremely large allocations, exhausting memory and causing denial of service. Affected processing paths include git_clone, git_fetch, git_remote_fetch, git_indexer_append, and operations on attacker-supplied local repositories.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Processing malicious Git pack data can cause excessive memory consumption and denial of service in applications using vulnerable libgit2 versions. Small inputs can trigger disproportionately large retained allocations, potentially exhausting memory available to the application or host. This vulnerability does not establish code execution, credential disclosure, or repository modification.
If you can’t patch tonight, do this now.
Until patched versions can be deployed, reduce exposure by avoiding processing untrusted repositories or pack data, especially from remote clone and fetch operations. Where feasible, isolate services that use libgit2, apply resource limits to constrain memory consumption, and restrict or pre-validate externally supplied repository content. These measures only reduce exploitability and impact; upgrading to a fixed version is the definitive mitigation.
Patch, then assume compromise.
Upgrade to libgit2 1.8.6 or later in the 1.8 release line, 1.9.5 or later in the 1.9 release line, or a distribution package containing the backported fix. Fixed Debian packages include 1.5.1+ds-1+deb12u2 for Debian 12 and 1.9.0+ds-2+deb13u1 for Debian 13. Update or rebuild applications that statically bundle vulnerable libgit2; updating only the system library does not replace embedded copies. The fix limits objects produced by delta application to 2 GiB by default, configurable through GIT_OPT_SET_PACK_MAX_OBJECT_SIZE.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.