CVE-2026-53585

NameCVE-2026-53585
Descriptionlibgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, git_delta_apply in src/libgit2/delta.c trusts the attacker-controlled res_sz value parsed by hdr_sz from a delta object header and passes that amount to git__malloc before validating delta instructions. Malicious pack data supplied through git_clone, git_fetch, git_remote_fetch, git_indexer_append, or a local attacker-supplied repository can use a very small multi-level OFS_DELTA chain to retain extremely large allocations and exhaust memory. This issue is fixed in versions 1.8.6 and 1.9.5.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-6453-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libgit2 (PTS)bullseye (security), bullseye1.1.0+dfsg.1-4+deb11u2vulnerable
bookworm, bookworm (security)1.5.1+ds-1+deb12u1vulnerable
trixie1.9.0+ds-2vulnerable
trixie (security)1.9.0+ds-2+deb13u1fixed
forky, sid1.9.7+ds-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libgit2sourcetrixie1.9.0+ds-2+deb13u1DSA-6453-1
libgit2source(unstable)1.9.6+ds-1

Notes

https://github.com/libgit2/libgit2/security/advisories/GHSA-27m5-gxxh-x79j
Fixed by: https://github.com/libgit2/libgit2/commit/0cdfdd5fa8f8514c82413025e1e0808866cf7c30 (v1.9.5)

Search for package or bug name: Reporting problems