libgit2’s git_delta_apply function consumes a size value from a delta object header without validating the accompanying delta instructions. If an attacker controls that value, the library can allocate an unbounded amount of memory, potentially exhausting system resources and causing a denial‑of‑service. The weakness is represented by CWE‑770 (Uncontrolled Memory Allocation).

The vulnerability affects the libgit2 library (libgit2:libgit2) in all releases older than 1.8.6 and 1.9.5. Applications that embed libgit2 and perform git operations such as clone, fetch, remote fetch, or indexer append can be impacted.

The vulnerability has a CVSS score of 5.3, placing it in the medium severity range, and it is not listed in the CISA KEV catalog. EPSS data is not available. The likely attack vector is the supply of malicious pack data through git_clone, git_fetch, remote fetch, or a locally supplied repository. An attacker who can supply such data can trigger large memory allocations, leading to service disruption.