CVE-2026-53585

A flaw was found in libgit2. The git_delta_apply function incorrectly trusts an attacker-controlled size value from a delta object header, which is used for memory allocation before proper validation of delta instructions. A remote attacker or local user can supply malicious pack data, for example, through git_clone or git_fetch, to trigger extremely large memory allocations. This can lead to the exhaustion of system memory, resulting in a Denial of Service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid cloning or fetching from untrusted Git repositories. Restricting access to systems that perform Git operations on untrusted data can also reduce exposure.