CVE-2026-82247

gitoxide's gix-url crate ?@ so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions = 0.49.0 fixed in 0.58.1...

CVE-2026-82247

CVE-2026-82247 affects the gix-url crate (≤ 0.32.0) within the gitoxide Rust library. Its hand-rolled URL parser fails to treat ? or # as authority terminators per RFC 3986 , causing gix-transport 's HTTP redirect identity guard (can_reuse_identity) to compare the wrong host and fail open . An at...

EUVD-2026-67699

gitoxide's gix-url crate ?@ so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions = 0.49.0 fixed in 0.58.1...