CVE-2026-53585
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
libgit2 before versions 1.8.6 and 1.9.5 has a vulnerability in git_delta_apply that trusts the attacker-controlled res_sz value, potentially leading to excessive memory allocations and memory exhaustion. Malicious pack data can be supplied via git_clone, git_fetch, git_remote_fetch, git_indexer_append, or a local repository.
Risk Assessment
The risk involves potential memory exhaustion, which could lead to denial of service (DoS).
Recommendation
It is recommended to upgrade libgit2 to version 1.8.6 or 1.9.5, which include the fix.
Other vulnerabilities in libgit2
See all- CVE-2016-10129High
The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line.
- CVE-2016-10128Critical
Buffer overflow in the git_pkt_parse_line function in Git Smart Protocol support in libgit2 before version 0.24.6 and 0.25.x before version 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.
- CVE-2026-53587High
libgit2 before versions 1.8.6 and 1.9.5 performs a fixed-size strncmp in set_data without verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can cause format_str to advance beyond the pkt-line and the following memchr length calculation to underflow, leading to a heap out-of-bounds read that can crash a client during the first refs-advertisement packet.
- CVE-2026-53586Medium
libgit2 before versions 1.8.6 and 1.9.5 has a vulnerability in the built-in HTTP transport that allows following an offsite redirect and sending credentials to an untrusted host. An attacker controlling a trusted Git host or an open redirect can disclose HTTP Basic credentials, personal access tokens, or equivalent credentials.
- CVE-2026-53584Medium
libgit2 before versions 1.8.6 and 1.9.5 does not reject traversal components in a submodule path loaded from .gitmodules. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree.
- CVE-2026-53583Medium
libgit2 before versions 1.8.6 and 1.9.5 has a vulnerability in verify_server_cert that uses an inverted !!memcmp result in the GEN_IPADD branch when comparing an IP-literal host with a certificate IP SubjectAltName. This causes rejection of matching IP addresses and acceptance of mismatched ones, allowing an attacker with a CA-trusted certificate to intercept connections to IP-literal HTTPS URLs.
- CVE-2026-5917High
libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.
Original NVD description (English source)
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, git_delta_apply in src/libgit2/delta.c trusts the attacker-controlled res_sz value parsed by hdr_sz from a delta object header and passes that amount to git__malloc before validating delta instructions. Malicious pack data supplied through git_clone, git_fetch, git_remote_fetch, git_indexer_append, or a local attacker-supplied repository can use a very small multi-level OFS_DELTA chain to retain extremely large allocations and exhaust memory. This issue is fixed in versions 1.8.6 and 1.9.5.