AZL-108087 CVE-2026-109349 affecting package rust 1.96.1-2

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::newfromheader: the pack header decoder accepts version 3, but a release-enabled asserteq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort t...

DEBIAN-CVE-2026-109349

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::newfromheader: the pack header decoder accepts version 3, but a release-enabled asserteq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort t...

DEBIAN-CVE-2026-109350

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFSDELTA entries. Attackers can serve a thin pack with a REFDELTA referencing an existing object followed by an OFSDELTA whose basedistan...

AZL-108084 CVE-2026-109349 affecting package rust 1.75.0-31

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::newfromheader: the pack header decoder accepts version 3, but a release-enabled asserteq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort t...

CVE-2026-109349

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::newfromheader: the pack header decoder accepts version 3, but a release-enabled asserteq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort t...

CVE-2026-109350

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFSDELTA entries. Attackers can serve a thin pack with a REFDELTA referencing an existing object followed by an OFSDELTA whose basedistan...

CVE-2026-108478

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.8...

UBUNTU-CVE-2026-109351

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::withcapacity to...

CVE-2026-109350

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFSDELTA entries. Attackers can serve a thin pack with a REFDELTA referencing an existing object followed by an OFSDELTA whose basedistan...

CVE-2026-109351

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::withcapacity to...

UBUNTU-CVE-2026-109349

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::newfromheader: the pack header decoder accepts version 3, but a release-enabled asserteq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort t...

UBUNTU-CVE-2026-109350

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFSDELTA entries. Attackers can serve a thin pack with a REFDELTA referencing an existing object followed by an OFSDELTA whose basedistan...

CVE-2026-109349

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::newfromheader: the pack header decoder accepts version 3, but a release-enabled asserteq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort t...

CVE-2026-108478 WordPress Element Pack Elementor Addons plugin <= 8.8.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.8...

EUVD-2026-97578

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.8...

CVE-2026-108478

The BdThemes Element Pack Elementor Addons (bdthemes-element-pack-lite) WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This vulnerability affects versions up to and including 8.8.8 . While the specific techni...

WordPress Element Pack Elementor Addons plugin <= 8.8.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Element Pack Elementor Addons versions = 8.8.8...

EUVD-2026-97652

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFSDELTA entries. Attackers can serve a thin pack with a REFDELTA referencing an existing object followed by an OFSDELTA whose basedistan...

CVE-2026-109351

The gitoxide gix-pack component (versions before 0.75.0 ) is vulnerable to an uncontrolled memory allocation flaw (CWE-770). A remote attacker can trigger a Denial of Service by providing a 12-byte pack header claiming a massive object count (e.g., 0xFFFFFFFF). This forces the Tree::with_capacity...

CVE-2026-109350 Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFSDELTA entries. Attackers can serve a thin pack with a REFDELTA referencing an existing object followed by an OFSDELTA whose basedistan...