TI-2026-38645 Aliases CVE-2026-53585

libgit2: Unbounded Memory Allocation via Delta Object Result-Size Header

MEDIUM 63CWE-770Published 2026-08-20 · Updated 2026-08-25

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Partial Red Hat: 1 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-770.

Summary

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, git_delta_apply in src/libgit2/delta.c trusts the attacker-controlled res_sz value parsed by hdr_sz from a delta object header and passes that amount to git__malloc before validating delta instructions. Malicious pack data supplied through git_clone, git_fetch, git_remote_fetch, git_indexer_append, or a local attacker-supplied repository can use a very small multi-level OFS_DELTA chain to retain extremely large allocations and exhaust memory. This issue is fixed in versions 1.8.6 and 1.9.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00395 33rd percentileScored 2026-11-07

Fix Partial libgit2 (libgit2): 1.8.6, 1.9.5Red Hat: 1 advisoryRed Hat: 1 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
libgit2	libgit2	before 1.8.6; 1.9.0 to before 1.9.5	1.8.6, 1.9.5	Patch available	CNA

libgit2 Vendorlibgit2 Affected before 1.8.6; 1.9.0 to before 1.9.5 Fixed in 1.8.6, 1.9.5 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:libgit2:libgit2::::::::	—	—	libgit2

cpe:2.3:a:libgit2:libgit2:*:*:*:*:*:*:*:* Versions — — ·libgit2

Remediation

Fix · CNA libgit2 (libgit2) Fixed in 1.8.6, 1.9.5

Red Hat 1 advisory

RHSA-2026:59361 Released 2026-08-25 · Red Hat rating Important
Red Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images libgit2-1.9.7-1.hum1@aarch64, libgit2-1.9.7-1.hum1@src, libgit2-1.9.7-1.hum1@x86_64 +2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3	Affected	No fix yet: Fix deferred
Red Hat Hardened Images	Fixed	RHSA-2026:59361

Timeline

2026-10-02 Threatist record created from CVE-2026-53585

References

Other 6

TI-2014-07619 Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x… CVSS 3.1CRITICAL 9.8
TI-2026-38647 libgit2 - Unauthenticated network-reachable heap out-of-bounds read in transports/smart_pkt.c:set_data CVSS 3.1HIGH 7.5
TI-2026-38643 libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Backend CVSS 3.1MEDIUM 6.5
TI-2024-16198 libgit2 is vulnerable to arbitrary code execution due to heap corruption in `git_index_add` CVSS 3.1CRITICAL 9.8
TI-2020-09811 An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. CVSS 3.1CRITICAL 9.8
TI-2020-09810 An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. CVSS 3.1CRITICAL 9.8

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences