{"id":"CVE-2026-53585","summary":"libgit2: Unbounded Memory Allocation via Delta Object Result-Size Header","details":"libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, git_delta_apply in src/libgit2/delta.c trusts the attacker-controlled res_sz value parsed by hdr_sz from a delta object header and passes that amount to git__malloc before validating delta instructions. Malicious pack data supplied through git_clone, git_fetch, git_remote_fetch, git_indexer_append, or a local attacker-supplied repository can use a very small multi-level OFS_DELTA chain to retain extremely large allocations and exhaust memory. This issue is fixed in versions 1.8.6 and 1.9.5.","aliases":["GHSA-27m5-gxxh-x79j"],"modified":"2026-08-22T09:15:52.184938Z","published":"2026-08-20T18:37:44.115Z","related":["openSUSE-SU-2026:11315-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53585.json"},"references":[{"type":"WEB","url":"https://github.com/libgit2/libgit2/releases/tag/v1.8.6"},{"type":"WEB","url":"https://github.com/libgit2/libgit2/releases/tag/v1.9.5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53585.json"},{"type":"ADVISORY","url":"https://github.com/libgit2/libgit2/security/advisories/GHSA-27m5-gxxh-x79j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53585"},{"type":"FIX","url":"https://github.com/libgit2/libgit2/commit/0cdfdd5fa8f8514c82413025e1e0808866cf7c30"},{"type":"FIX","url":"https://github.com/libgit2/libgit2/commit/c1896f06df22cc0ca5658df3a8f6cd7ede4cd6ae"},{"type":"FIX","url":"https://github.com/libgit2/libgit2/commit/dec22ac01ad9620c96b7b9ac3ef636ea46d43bed"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libgit2/libgit2","events":[{"introduced":"0"},{"introduced":"338e6fb681369ff0537719095e22ce9dc602dbf0"},{"fixed":"5853918c4c6a7b12f8becf4bd11ff4362ebb9020"},{"fixed":"f7a4071c766ceea3915415e22134cbe3e581c420"},{"fixed":"0cdfdd5fa8f8514c82413025e1e0808866cf7c30"},{"fixed":"c1896f06df22cc0ca5658df3a8f6cd7ede4cd6ae"},{"fixed":"dec22ac01ad9620c96b7b9ac3ef636ea46d43bed"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"1.8.6"},{"introduced":"1.9.0"},{"fixed":"1.9.5"}]}}],"versions":["v1.8.5","v1.9.4","v1.9.3","v1.9.2","v1.9.1","v1.8.4","v1.9.0","v1.8.3","v1.8.1","v1.8.0","v1.7.0","v1.6.3","v1.6.2","v1.6.1","v1.5.0","v1.3.0","v1.4.0","v1.2.0","v1.1.0","v1.0.0","v0.99.0","v0.28.0-rc1","v0.28.0","v0.27.0","v0.27.0-rc3","v0.26.0-rc2","v0.26.0","v0.27.0-rc1","v0.27.0-rc2","v0.26.0-rc1","v0.24.0","v0.24.0-rc1","v0.23.0","v0.23.0-rc2","v0.23.0-rc1","v0.22.0","v0.22.0-rc2","v0.22.0-rc1","v0.21.0","v0.18.0","v0.17.0","v0.16.0","v0.15.0","v0.14.0","v0.13.0","v0.12.0","v0.11.0","v0.10.0","v0.8.0","v0.3.0","v0.2.0","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53585.json","vanir_signatures_modified":"2026-08-22T09:15:52Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/c1896f06df22cc0ca5658df3a8f6cd7ede4cd6ae","target":{"file":"src/libgit2/indexer.c"},"deprecated":false,"digest":{"line_hashes":["98314887506863016040934533821855767443","129485872745537633186875885613126360957","140374114568019037884682824946558833071","60441248420350735998922454280300946665"],"threshold":0.9},"id":"CVE-2026-53585-0ec0ba53","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/0cdfdd5fa8f8514c82413025e1e0808866cf7c30","target":{"file":"src/libgit2/settings.c"},"deprecated":false,"digest":{"line_hashes":["276797562670809850406578177733803990782","309688685723693765354735927012648645635","190694080289304935388274368860767275848","306071047223806163265071711301759893572","287839466121220864194045895411125024334","250270162916552703845764982849529180180","228647583579931917622678456425530442359"],"threshold":0.9},"id":"CVE-2026-53585-1e441d84","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"187058112028525669558542122900187103674","length":1690},"id":"CVE-2026-53585-1f46e5b7","signature_type":"Function","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/0cdfdd5fa8f8514c82413025e1e0808866cf7c30","target":{"file":"src/libgit2/delta.c","function":"git_delta_apply"}},{"deprecated":false,"digest":{"line_hashes":["276797562670809850406578177733803990782","309688685723693765354735927012648645635","190694080289304935388274368860767275848","306071047223806163265071711301759893572","287839466121220864194045895411125024334","250270162916552703845764982849529180180","228647583579931917622678456425530442359"],"threshold":0.9},"id":"CVE-2026-53585-28d94888","signature_type":"Line","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/c1896f06df22cc0ca5658df3a8f6cd7ede4cd6ae","target":{"file":"src/libgit2/settings.c"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/0cdfdd5fa8f8514c82413025e1e0808866cf7c30","target":{"file":"src/libgit2/delta.c"},"deprecated":false,"digest":{"line_hashes":["11847292412191345390472033527037395008","291763246147385271242696376797855787068","44239344862099282244430338476245018534","39458340543595487695081337935126557801"],"threshold":0.9},"id":"CVE-2026-53585-31e135c0"},{"id":"CVE-2026-53585-32131f6e","signature_type":"Line","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/0cdfdd5fa8f8514c82413025e1e0808866cf7c30","target":{"file":"include/git2/common.h"},"deprecated":false,"digest":{"line_hashes":["322419775602955870513131206755833816401","30815615013481723653394767288392399077","254205498629186845123051467901572198399","254516340141257634936251672018564117832","6228900983806554862375446726712371710"],"threshold":0.9}},{"digest":{"line_hashes":["322419775602955870513131206755833816401","30815615013481723653394767288392399077","254205498629186845123051467901572198399","151749277107460116896741943039685091793","135812393966443071673630870334565393659"],"threshold":0.9},"id":"CVE-2026-53585-5e65d911","signature_type":"Line","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/dec22ac01ad9620c96b7b9ac3ef636ea46d43bed","target":{"file":"include/git2/common.h"},"deprecated":false},{"source":"https://github.com/libgit2/libgit2/commit/c1896f06df22cc0ca5658df3a8f6cd7ede4cd6ae","target":{"file":"include/git2/common.h"},"deprecated":false,"digest":{"line_hashes":["329065248623906116677085497315616581932","324776365542815193549337123300866832332","92389566152423929980613487046087646483","292381138642903277454925976488446856623","6228900983806554862375446726712371710"],"threshold":0.9},"id":"CVE-2026-53585-8279c07c","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-53585-a2215356","signature_type":"Function","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/c1896f06df22cc0ca5658df3a8f6cd7ede4cd6ae","target":{"file":"src/libgit2/settings.c","function":"git_libgit2_opts"},"deprecated":false,"digest":{"function_hash":"179045522176535590565896735147266790498","length":7948}},{"deprecated":false,"digest":{"line_hashes":["276797562670809850406578177733803990782","309688685723693765354735927012648645635","190694080289304935388274368860767275848","306071047223806163265071711301759893572","287839466121220864194045895411125024334","250270162916552703845764982849529180180","228647583579931917622678456425530442359"],"threshold":0.9},"id":"CVE-2026-53585-b4a9db1d","signature_type":"Line","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/dec22ac01ad9620c96b7b9ac3ef636ea46d43bed","target":{"file":"src/libgit2/settings.c"}},{"signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/dec22ac01ad9620c96b7b9ac3ef636ea46d43bed","target":{"file":"src/libgit2/settings.c","function":"git_libgit2_opts"},"deprecated":false,"digest":{"function_hash":"155683997394843241788045906684252057898","length":8373},"id":"CVE-2026-53585-be720003","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/dec22ac01ad9620c96b7b9ac3ef636ea46d43bed","target":{"file":"src/libgit2/delta.c","function":"git_delta_apply"},"deprecated":false,"digest":{"function_hash":"187058112028525669558542122900187103674","length":1690},"id":"CVE-2026-53585-c8f19975"},{"digest":{"line_hashes":["82880233150859665763812403606104011472","16523816586629741018921487601133916821","77729036432600100567280227681073885575","292809617235869703843482351740907620540"],"threshold":0.9},"id":"CVE-2026-53585-d221900c","signature_type":"Line","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/dec22ac01ad9620c96b7b9ac3ef636ea46d43bed","target":{"file":"src/libgit2/indexer.c"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/c1896f06df22cc0ca5658df3a8f6cd7ede4cd6ae","target":{"file":"src/libgit2/delta.c","function":"git_delta_apply"},"deprecated":false,"digest":{"function_hash":"187058112028525669558542122900187103674","length":1690},"id":"CVE-2026-53585-d8b61f76","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["11847292412191345390472033527037395008","291763246147385271242696376797855787068","44239344862099282244430338476245018534","39458340543595487695081337935126557801"],"threshold":0.9},"id":"CVE-2026-53585-e3c94ff4","signature_type":"Line","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/c1896f06df22cc0ca5658df3a8f6cd7ede4cd6ae","target":{"file":"src/libgit2/delta.c"}},{"source":"https://github.com/libgit2/libgit2/commit/0cdfdd5fa8f8514c82413025e1e0808866cf7c30","target":{"file":"src/libgit2/settings.c","function":"git_libgit2_opts"},"deprecated":false,"digest":{"function_hash":"314584519456285528170966202138560732416","length":8193},"id":"CVE-2026-53585-e446ebc4","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["11847292412191345390472033527037395008","291763246147385271242696376797855787068","44239344862099282244430338476245018534","39458340543595487695081337935126557801"],"threshold":0.9},"id":"CVE-2026-53585-e492769d","signature_type":"Line","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/dec22ac01ad9620c96b7b9ac3ef636ea46d43bed","target":{"file":"src/libgit2/delta.c"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/0cdfdd5fa8f8514c82413025e1e0808866cf7c30","target":{"file":"src/libgit2/indexer.c"},"deprecated":false,"digest":{"line_hashes":["82880233150859665763812403606104011472","16523816586629741018921487601133916821","77729036432600100567280227681073885575","292809617235869703843482351740907620540"],"threshold":0.9},"id":"CVE-2026-53585-e4d348b6"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}