CVE-2026-53585: 
Bat vulnerability analysis and mitigation

CVE-2026-53585 is an unbounded memory allocation vulnerability in libgit2's delta object processing, classified as "Allocation of Resources Without Limits or Throttling" (CWE-770). It affects libgit2 versions prior to 1.8.6 and 1.9.5, as well as the libgit2-sys Rust crate prior to version 0.18.7. The vulnerability was discovered by Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team and disclosed on July 18, 2026. It carries a CVSS v3.1 score of 5.3 (Moderate) per the GitHub advisory, though the advisory notes the score rises to 7.5 (High) in automated pipeline scenarios where no user interaction is required (GitHub Advisory, Ubuntu Advisory).

The root cause lies in git_delta_apply() within delta.c, which reads the claimed result size (res_sz) from the delta object header — data entirely controlled by the sender — and immediately allocates a buffer of that size before validating any delta instructions (CWE-770). The only existing guard, GIT_ERROR_CHECK_ALLOC_ADD, prevents integer overflow at SIZE_MAX but imposes no semantic upper bound on the allocation size. Because res_sz is encoded as a variable-length integer, values up to SIZE_MAX-1 can be encoded in just a few bytes, and multi-level OFS_DELTA chains allow a single small pack file to trigger exponentially larger allocations at each level. Affected code paths include git_clone, git_fetch, git_remote_fetch, git_indexer_append(), and git_indexer_commit(). A public proof-of-concept was included in the advisory, demonstrating that a 374-byte pack file can trigger ~118 MB RSS increase and a 412-byte pack file can trigger ~1.03 GB RSS increase (GitHub Advisory).

Successful exploitation results in complete process memory exhaustion from a single network connection, causing a denial of service. A 412-byte crafted pack file can trigger over 1 GB of memory allocation (amplification ratio of ~2,614,000×), and larger chains or res_sz values can exhaust all available RAM on the host. The vulnerability has no confidentiality or integrity impact, but availability impact is severe — any application embedding libgit2 that fetches from untrusted remotes (including CI/CD pipelines, Git hosting services, and developer tools) is at risk (GitHub Advisory, Ubuntu Advisory).

A working proof-of-concept with crafted pack files (delta_100mb.pack and chain_1gb.pack) and a test harness was published as part of the GitHub Security Advisory. No authentication is required — the attack fires the moment a client opens a connection to an attacker-controlled repository URL. No evidence of in-the-wild exploitation or threat actor attribution has been reported at this time, and the CVE is not currently listed in the CISA KEV catalog. The vulnerability is detected by multiple Qualys and Nessus plugins, indicating broad scanner coverage (GitHub Advisory).

1. Set up a malicious Git server: Configure an attacker-controlled Git repository accessible via HTTP/HTTPS, SSH, or the native Git protocol.
2. Generate crafted pack files: Use the published Python PoC script (gen_packs.py) to create pack files containing OFS_DELTA objects with inflated res_sz headers — e.g., a 374-byte pack claiming 100 MB result size, or a 412-byte two-level delta chain claiming 1 GB.
3. Serve the malicious pack: Configure the Git server to serve the crafted pack file in response to clone or fetch requests.
4. Lure the victim: Trick a user or automated system (e.g., CI/CD pipeline) into cloning or fetching from the malicious repository URL using any application that embeds libgit2.
5. Trigger memory exhaustion: When git_delta_apply() processes the delta object, it reads the attacker-controlled res_sz and allocates a buffer of that size unconditionally. With a multi-level delta chain, each level multiplies the allocation, rapidly exhausting available RAM and causing the host process (or system) to crash or become unresponsive (GitHub Advisory).

• Network: Inbound or outbound connections to unknown/untrusted Git repository URLs initiated by processes embedding libgit2; unusually small pack files (< 1 KB) transferred over Git protocols followed by large memory spikes.
• Process: Sudden and extreme RSS/memory growth in processes using libgit2 (e.g., git clients, CI/CD agents, IDE backends) during clone or fetch operations; OOM-killer events (oom_kill_process) in system logs targeting libgit2-linked processes.
• Logs: System logs (/var/log/syslog, dmesg) showing out-of-memory events correlated with Git network activity; application crash logs from libgit2-linked tools during pack indexing operations.
• File System: Presence of small (< 1 KB) .pack files in temporary directories (e.g., /tmp/idx_*) that trigger disproportionate memory usage when processed (GitHub Advisory).

Upgrade libgit2 to version 1.8.6 or 1.9.5 (patched versions), and upgrade the libgit2-sys Rust crate to 0.18.7 or later. Ubuntu has released patched packages for all supported LTS releases (e.g., libgit2-1.9 1.9.1+ds-1ubuntu1.1 for 26.04 LTS, libgit2-1.7 1.7.2+ds-1ubuntu3.1 for 24.04 LTS); older releases require Ubuntu Pro for ESM fixes. As a workaround where patching is not immediately possible, restrict libgit2-linked applications from connecting to untrusted or user-supplied repository URLs, particularly in CI/CD environments. The suggested code fix is to add a result-size guard in delta.c rejecting res_sz values exceeding 2 GB before any allocation occurs (GitHub Advisory, Ubuntu Advisory).

The vulnerability was disclosed via a detailed GitHub Security Advisory by the libgit2 maintainers, crediting Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team as finders. Ubuntu, openSUSE, Fedora, and Debian have all issued security advisories and package updates in response. Security scanner vendors Tenable (Nessus) and Qualys have published detection plugins. Coverage has appeared on Linux security news aggregators including linuxsecurity.com and pro-linux.de (GitHub Advisory, Ubuntu Advisory).