CVE-2026-53585: libgit2

CVSS: 5.3v3.1MediumAwaiting analysis

AliasesUBUNTU-CVE-2026-53585DEBIAN-CVE-2026-53585

Published 20-08-2026Last modified 25-08-2026

Vulnerability summary

CVE-2026-53585 is a medium (CVSS 5.3) vulnerability in libgit2. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 32.4% of scored vulnerabilities.

Overall risk

21/100

0100

Low · default modelHow is this calculated?

CVSS score

5.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.40%

0%100%

Low · +0.07 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 2

OPENSUSE-SU-2026:11315-1 RHSA-2026:59361 USN-8628-1

Timeline

20-08-2026
PublishedVulnerability first disclosed.
25-08-2026
Last modifiedVulnerability information updated.

Description

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, git_delta_apply in src/libgit2/delta.c trusts the attacker-controlled res_sz value parsed by hdr_sz from a delta object header and passes that amount to git__malloc before validating delta instructions. Malicious pack data supplied through git_clone, git_fetch, git_remote_fetch, git_indexer_append, or a local attacker-supplied repository can use a very small multi-level OFS_DELTA chain to retain extremely large allocations and exhaust memory. This issue is fixed in versions 1.8.6 and 1.9.5.

CVSS metrics

4 scores · 4 sources · 1 version

v3.15.3

EPSS trend

Probability

0.40%

Chance of exploitation in the next 30 days

Percentile

32%

Versus all other CVEs

30-day change

+0.07 pp

From 0.33% on 21-09-2026

21-09-202621-10-2026

EPSS score

0.40%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected systems

Debian1 product

libgit2All versions (No fix recorded) | < 1.5.1+ds-1+deb12u2 | < 1.9.0+ds-2+deb13u1 | < 1.9.6+ds-1

Libgit21 product

libgit2< 1.8.6 | ≥ 1.9.0, < 1.9.5

Ubuntu1 product

libgit2< 0.19.0-2ubuntu0.4+esm2 | < 0.24.1-2ubuntu0.2+esm3 | < 0.26.0+dfsg.1-1.1ubuntu0.2+esm2 | < 0.28.4+dfsg.1-2ubuntu0.1+esm1 | < 1.1.0+dfsg.1-4.1ubuntu0.1+esm1 | < 1.7.2+ds-1ubuntu3.1 | < 1.9.1+ds-1ubuntu1.1

3 vendors · 3 products