Description

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, git_delta_apply in src/libgit2/delta.c trusts the attacker-controlled res_sz value parsed by hdr_sz from a delta object header and passes that amount to git__malloc before validating delta instructions. Malicious pack data supplied through git_clone, git_fetch, git_remote_fetch, git_indexer_append, or a local attacker-supplied repository can use a very small multi-level OFS_DELTA chain to retain extremely large allocations and exhaust memory. This issue is fixed in versions 1.8.6 and 1.9.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-20T19:16:54.837Z",
  "pubdate": "2026-08-20T19:16:54.837Z",
  "executiveSummary": "A memory exhaustion vulnerability exists in libgit2 prior to versions 1.8.6 and 1.9.5, specifically within the delta application logic.\nThe vulnerability is classified as a resource management flaw involving untrusted size calculation, allowing an attacker to trigger excessive memory allocations.\nThe affected product is libgit2, a portable C implementation of the Git core methods, impacting operations that process untrusted pack data such as git_clone, git_fetch, git_remote_fetch, git_indexer_append, or local repositories.\nRisk implications include severe denial of service via out-of-memory crashes on host systems processing malicious repositories.\nAttacker capabilities involve supplying crafted pack data or a local attacker-supplied repository containing malicious delta objects.\nExploitation requirements include the target application processing malicious pack data or interacting with a crafted local repository.",
  "technicalDetails": "The root cause of the vulnerability resides in the function git_delta_apply located within src/libgit2/delta.c.\nThe function trusts the attacker-controlled res_sz value parsed by hdr_sz from a delta object header without performing prior validation against the accompanying delta instructions.\nIt passes this unverified size directly to git__malloc before parsing or validating the delta instructions that describe how the reconstructed data should be built.\nMalicious pack data can be supplied through various ingestion vectors including git_clone, git_fetch, git_remote_fetch, git_indexer_append, or via a local attacker-supplied repository.\nAttackers utilize a very small multi-level OFS_DELTA chain within the pack data to retain extremely large memory allocations without requiring massive physical data payloads on disk.\nThe attack flow proceeds as follows: 1) The victim application initiates a clone, fetch, indexing, or local repository load operation containing crafted pack data. 2) libgit2 parses the delta object header, extracting the attacker-controlled res_sz value via hdr_sz. 3) The library allocates a massive buffer via git__malloc based on this bloated size parameter. 4) The large allocation is retained in memory. 5) Repeating or chaining this process exhausts available system memory, leading to a denial of service.\nAffected versions of libgit2 include all versions prior to 1.8.6 and 1.9.5.\nAuthentication requirements, privilege requirements, and network exposure depend entirely on the attack vector utilized by the threat actor, ranging from local file access to remote operations via network fetch mechanisms."
}