Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-20T18:37:44 libgit2: libgit2: Denial of Service via Unbounded Memory Allocation 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CWE-770

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, git_delta_apply in src/libgit2/delta.c trusts the attacker-controlled res_sz value parsed by hdr_sz from a delta object header and passes that amount to git__malloc before validating delta instructions. Malicious pack data supplied through git_clone, git_fetch, git_remote_fetch, git_indexer_append, or a local attacker-supplied repository can use a very small multi-level OFS_DELTA chain to retain extremely large allocations and exhaust memory. This issue is fixed in versions 1.8.6 and 1.9.5.

A flaw was found in libgit2. The `git_delta_apply` function incorrectly trusts an attacker-controlled size value from a delta object header, which is used for memory allocation before proper validation of delta instructions. A remote attacker or local user can supply malicious pack data, for example, through `git_clone` or `git_fetch`, to trigger extremely large memory allocations. This can lead to the exhaustion of system memory, resulting in a Denial of Service (DoS).

To mitigate this issue, avoid cloning or fetching from untrusted Git repositories. Restricting access to systems that perform Git operations on untrusted data can also reduce exposure. Red Hat Hardened Images 2026-08-25T00:00:00Z RHSA-2026:59361 libgit2-main-1.9.7-1.hum1 Red Hat Enterprise Linux 10 Fix deferred rust Red Hat Enterprise Linux 8 Fix deferred libgit2 Red Hat Enterprise Linux 9 Fix deferred rust Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred libgit2 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rust https://www.cve.org/CVERecord?id=CVE-2026-53585 https://nvd.nist.gov/vuln/detail/CVE-2026-53585 https://github.com/libgit2/libgit2/commit/0cdfdd5fa8f8514c82413025e1e0808866cf7c30 https://github.com/libgit2/libgit2/commit/c1896f06df22cc0ca5658df3a8f6cd7ede4cd6ae https://github.com/libgit2/libgit2/commit/dec22ac01ad9620c96b7b9ac3ef636ea46d43bed https://github.com/libgit2/libgit2/releases/tag/v1.8.6 https://github.com/libgit2/libgit2/releases/tag/v1.9.5 https://github.com/libgit2/libgit2/security/advisories/GHSA-27m5-gxxh-x79j