gix-pack: gix-pack: Denial of Service via crafted pack-header object count

A flaw was found in the gix-pack component of Gitoxide. A malicious remote repository can cause a Denial of Service DoS by providing a crafted pack header with an excessively large object count during clone or fetch operations. This forces the client to attempt an uncontrolled memory allocation,...

gix-pack: gix-pack: Denial of Service via crafted pack-header object count

A flaw was found in the gix-pack component of Gitoxide. A malicious remote repository can cause a Denial of Service DoS by providing a crafted pack header with an excessively large object count during clone or fetch operations. This forces the client to attempt an uncontrolled memory allocation,...

Security Bulletin: Cargo in IBM Open SDK for Rust on AIX uses a vulnerable version of gix crates

Summary Vulnerabilites were discovered in the gix family of crates used by the cargo package manager in IBM Open SDK for Rust on AIX 1.94.0.1 and 1.96.0.0. Vulnerability Details CVEID:CVE-2026-82248 DESCRIPTION: gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the...

SUSE CVE-2026-109349

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::newfromheader: the pack header decoder accepts version 3, but a release-enabled asserteq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort t...

SUSE CVE-2026-109350

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFSDELTA entries. Attackers can serve a thin pack with a REFDELTA referencing an existing object followed by an OFSDELTA whose basedistan...

SUSE CVE-2026-109351

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::withcapacity to...

CVE-2026-109351

A flaw was found in the gix-pack component of Gitoxide. A malicious remote repository can cause a Denial of Service DoS by providing a crafted pack header with an excessively large object count during clone or fetch operations. This forces the client to attempt an uncontrolled memory allocation,...

DEBIAN-CVE-2026-109351

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::withcapacity to...

CVE-2026-109351

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::withcapacity to...

AZL-108084 CVE-2026-109349 affecting package rust 1.75.0-31

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::newfromheader: the pack header decoder accepts version 3, but a release-enabled asserteq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort t...

AZL-108087 CVE-2026-109349 affecting package rust 1.96.1-2

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::newfromheader: the pack header decoder accepts version 3, but a release-enabled asserteq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort t...

DEBIAN-CVE-2026-109349

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::newfromheader: the pack header decoder accepts version 3, but a release-enabled asserteq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort t...

DEBIAN-CVE-2026-109350

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFSDELTA entries. Attackers can serve a thin pack with a REFDELTA referencing an existing object followed by an OFSDELTA whose basedistan...

DEBIAN-CVE-2026-109348

Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::frombytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers runnin...

CVE-2026-109348

Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::frombytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers runnin...

CVE-2026-109350

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFSDELTA entries. Attackers can serve a thin pack with a REFDELTA referencing an existing object followed by an OFSDELTA whose basedistan...

CVE-2026-109349

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::newfromheader: the pack header decoder accepts version 3, but a release-enabled asserteq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort t...

UBUNTU-CVE-2026-109348

Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::frombytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers runnin...

CVE-2026-109348

Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::frombytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers runnin...

CVE-2026-109350

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFSDELTA entries. Attackers can serve a thin pack with a REFDELTA referencing an existing object followed by an OFSDELTA whose basedistan...