CVE-2026-53585 libgit2: Unbounded Memory Allocation via Delta Object Result-Size Header
Attackers can cause memory exhaustion and denial of service in applications using libgit2 by supplying malicious pack data with oversized delta headers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53585?
CVE-2026-53585 is a medium-severity denial of service vulnerability in libgit2, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, git_delta_apply in src/libgit2/delta.c trusts the attacker-controlled res_sz value parsed by hdr_sz from a delta object header and passes that amount to git__malloc before validating delta instructions. Malicious pack data supplied through git_clone, git_fetch, git_remote_fetch, git_indexer_append, or a local attacker-supplied repository can use a very small multi-level OFS_DELTA chain to retain extremely large allocations and exhaust memory. This issue is fixed in versions 1.8.6 and 1.9.5.
Weakness: CWE-770
Which versions are affected by CVE-2026-53585?
How do I fix CVE-2026-53585?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-53585 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53585 exists.
Sources
Also known as AZL-96965, BELL-CVE-2026-53585, DEBIAN-CVE-2026-53585, ECHO-11a9-f023-aa1d, GHSA-27m5-gxxh-x79j, JLSEC-2026-1371 and 1 more.