Bug 2566189 (CVE-2026-63476)

Summary: CVE-2026-63476 isomorphic-git: isomorphic-git: Denial of Service via unbounded memory allocation during packfile processing
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abarbaro, alizardo, dhanak, drosa, dschmidt, dsimansk, ikhan, jchui, jhe, jlanda, kingland, kshier, ktsao, mnovotny, nboldt, oaljalju, psrna, rbobbitt, sausingh, simaishi, stcannon, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in isomorphic-git. A malicious or compromised remote Git server can cause a Denial of Service (DoS) by sending a specially crafted packfile delta header with an excessively large target size during clone or fetch operations. Because isomorphic-git allocates memory for the target size without proper bounds checking, this issue leads to excessive memory consumption and can crash applications running in memory-constrained environments, such as containers or serverless functions.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-03 20:02:52 UTC 
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta in src/utils/applyDelta.js and passes it without a bound to Buffer.alloc(targetSize). A malicious or man-in-the-middle-controlled remote can send one delta header that causes git.clone() or git.fetch() to allocate approximately 2 GB before validating the actual delta output. GitPackIndex.fromPack swallows the later size-mismatch error, so a host with sufficient memory may retain the resource waste without a visible failure, while containers, serverless functions, and small virtual machines may terminate. Node.js heap limits do not mitigate the off-heap Buffer allocation. This issue is fixed in version 1.38.6.