checkout-index

checkout-index - Reproducer for CVE-2025-22620 This is the proof of concept code for RUSTSEC-2025-0001 CVE-2025-22620, GHSA-fqmf-w4xh-33rh. It is the same code as in the advisory, but in the form of a Rust project, with Cargo.toml and Cargo.lock included. This repo was useful while writing the...

gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()

Summary In the gix crate, Cache::protectoptions in gix/src/config/cache/access.rs reads the three filesystem path-protection settings core.protectHFS, core.protectNTFS, and gitoxide.core.protectWindows with the unfiltered gixconfig::File::boolean accessor instead of the trust-aware booleanfilter...

GHSA-Q54R-JF2P-RFR2 gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()

Summary In the gix crate, Cache::protectoptions in gix/src/config/cache/access.rs reads the three filesystem path-protection settings core.protectHFS, core.protectNTFS, and gitoxide.core.protectWindows with the unfiltered gixconfig::File::boolean accessor instead of the trust-aware booleanfilter...

openSUSE 16: grok-build / grok-build-bash-completion / etc (openSUSE-SU-2026:22130-1)

"The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22130-1 advisory. Changes in grok-build: - CVE-2026-109349: gix-pack pack version 3 header assertion failure boo1285155 - CVE-2026-109350: gix-pack ofs-delta...

Linux Distros Unpatched Vulnerability : CVE-2026-109350

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack...

Linux Distros Unpatched Vulnerability : CVE-2026-109351

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge...

Linux Distros Unpatched Vulnerability : CVE-2026-109349

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::newfromheader: the pack header decoder accepts version 3, but a...

Linux Distros Unpatched Vulnerability : CVE-2026-109348

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in...

Security update for gitoxide (moderate)

openSUSE security update: security update for gitoxide ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22126-1 Rating: moderate References: bsc1281749 Cross-References: CVE-2026-91986 CVSS scores: CVE-2026-91986 SUSE : 5.4...

Security update for grok-build (important)

openSUSE security update: security update for grok-build ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22130-1 Rating: important References: bsc1285155 Cross-References: CVE-2026-109349 CVE-2026-109350 CVE-2026-109351 CVSS scores: CVE-2026-109349...

OPENSUSE-SU-2026:22130-1 Security update for grok-build

This update for grok-build fixes the following issues: Changes in grok-build: - CVE-2026-109349: gix-pack pack version 3 header assertion failure boo1285155 - CVE-2026-109350: gix-pack ofs-delta base-distance handling flaw boo1285155 - CVE-2026-109351: gix-pack header object-count denial of servi...

gix-pack: gix-pack: Denial of Service via crafted pack header

A flaw was found in gix-pack. A malicious remote server can trigger a Denial of Service DoS by returning a crafted pack header declaring version 3 during a repository clone or fetch operation. Because the header decoder triggers an internal assertion failure when encountering this version, the...

gix-pack: gix-pack: Denial of Service via malformed packfile delta entries

A flaw was found in gix-pack. A malicious remote repository can cause a Denial of Service DoS by serving a crafted Git packfile containing malformed delta offset entries during a fetch operation. Processing these entries leads to an unhandled application crash, abruptly terminating the fetch...

gix-pack: gix-pack: Denial of Service via crafted pack-header object count

A flaw was found in the gix-pack component of Gitoxide. A malicious remote repository can cause a Denial of Service DoS by providing a crafted pack header with an excessively large object count during clone or fetch operations. This forces the client to attempt an uncontrolled memory allocation,...

gix-pack: gix-pack: Denial of Service via crafted pack header

A flaw was found in gix-pack. A malicious remote server can trigger a Denial of Service DoS by returning a crafted pack header declaring version 3 during a repository clone or fetch operation. Because the header decoder triggers an internal assertion failure when encountering this version, the...

gix-pack: gix-pack: Denial of Service via malformed packfile delta entries

A flaw was found in gix-pack. A malicious remote repository can cause a Denial of Service DoS by serving a crafted Git packfile containing malformed delta offset entries during a fetch operation. Processing these entries leads to an unhandled application crash, abruptly terminating the fetch...

gix-pack: gix-pack: Denial of Service via crafted pack-header object count

A flaw was found in the gix-pack component of Gitoxide. A malicious remote repository can cause a Denial of Service DoS by providing a crafted pack header with an excessively large object count during clone or fetch operations. This forces the client to attempt an uncontrolled memory allocation,...

Security Bulletin: Cargo in IBM Open SDK for Rust on AIX uses a vulnerable version of gix crates

Summary Vulnerabilites were discovered in the gix family of crates used by the cargo package manager in IBM Open SDK for Rust on AIX 1.94.0.1 and 1.96.0.0. Vulnerability Details CVEID:CVE-2026-82248 DESCRIPTION: gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the...

SUSE CVE-2026-109348

Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::frombytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers runnin...

SUSE CVE-2026-109349

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::newfromheader: the pack header decoder accepts version 3, but a release-enabled asserteq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort t...