CVE-2017-15298: Canonical Ubuntu Linux

Medium severity, CVSS 5.5. EPSS: 1.6% chance of exploitation in the next 30 days.

Git through 2.14.2 mishandles layers of tree objects, which allows remote attackers to cause a denial of service (memory consumption) via a crafted repository, aka a Git bomb. This can also have an impact of disk consumption; however, an affected process typically would not survive its attempt to build the data structure in memory before writing to disk.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 18.04 only; version 18.10 only
• Git-Scm Git: up to and including 2.14.2

Published 2017-10-14. Last modified 2026-06-17.